Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-3npq-hj69-cygg
Vulnerability ID VCID-3npq-hj69-cygg
Aliases CVE-2026-35349
GHSA-v762-x3cf-5mfg
Summary A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-59 Improper Link Resolution Before File Access ('Link Following')
System Score Found at
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2026-35349
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-35349
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2026-35349
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-v762-x3cf-5mfg
cvssv3.1 6.7 https://github.com/uutils/coreutils
generic_textual MODERATE https://github.com/uutils/coreutils
cvssv3.1 6.7 https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
generic_textual MODERATE https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
cvssv3.1 6.7 https://github.com/uutils/coreutils/pull/9706
generic_textual MODERATE https://github.com/uutils/coreutils/pull/9706
ssvc Track https://github.com/uutils/coreutils/pull/9706
cvssv3.1 6.7 https://github.com/uutils/coreutils/releases/tag/0.7.0
generic_textual MODERATE https://github.com/uutils/coreutils/releases/tag/0.7.0
ssvc Track https://github.com/uutils/coreutils/releases/tag/0.7.0
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2026-35349
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-35349
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35349
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
https://nvd.nist.gov/vuln/detail/CVE-2026-35349
0.7.0 https://github.com/uutils/coreutils/releases/tag/0.7.0
9706 https://github.com/uutils/coreutils/pull/9706
GHSA-v762-x3cf-5mfg https://github.com/advisories/GHSA-v762-x3cf-5mfg
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Found at https://github.com/uutils/coreutils
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Found at https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Found at https://github.com/uutils/coreutils/pull/9706
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:04:49Z/ Found at https://github.com/uutils/coreutils/pull/9706
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Found at https://github.com/uutils/coreutils/releases/tag/0.7.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T18:04:49Z/ Found at https://github.com/uutils/coreutils/releases/tag/0.7.0
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35349
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.03711
EPSS Score 0.00016
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:45:01.990554+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35349.json 38.6.0