CVE-2026-35339

The record

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

Affected packages

Related vulnerabilities

• GHSA-vp6q-mv9j-j428 uutils coreutils incorrectly handles exit codes when processing multiple files Same vulnerability
• GHSA-532v-xp3f-837c uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut… Also affects coreutils
• GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition Also affects coreutils
• GHSA-53gr-wmf4-8hh3 uutils coreutils's User Interface (UI) Misrepresents Critical Information Also affects coreutils
• GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue Also affects coreutils
• GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility Also affects coreutils
• GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition Also affects coreutils
• GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue Also affects coreutils