CVE-2026-35359

What it actually does

This is a local race condition in the uutils coreutils implementation of cp. When cp is intended not to follow symbolic links, it first checks a source path using path-based metadata, but later opens that path without enforcing O_NOFOLLOW. A local attacker who can modify the source path concurrently can replace a checked regular file with a symbolic link during the small time-of-check to time-of-use window. If a privileged process is running cp against attacker-writable paths, the attacker can cause cp to read an arbitrary file accessible to that privileged process and write its contents to a destination the attacker can read. The primary impact is unauthorized disclosure of sensitive local files; integrity and availability are not directly affected.

Why it matters to the business

Successful exploitation can expose sensitive files such as secrets, configuration files, private keys, tokens, or other privileged local data if automated jobs, scripts, installers, packaging workflows, or administrative tasks run the affected cp utility over attacker-writable paths. Exploitation requires local access, low privileges, and precise timing, and current EPSS is very low with no known KEV listing or reported exploit maturity, so broad opportunistic exploitation is unlikely; however, systems that process files from untrusted local users or shared workspaces are at higher risk.

How an attack unfolds

An attacker first obtains local access to a system where uutils coreutils cp is used by a more privileged process. The attacker identifies a workflow where cp copies files from a directory or path the attacker can modify, while the resulting destination is readable by the attacker or otherwise exposed. The attacker prepares a benign regular file so the initial metadata check succeeds, then repeatedly replaces that file with a symbolic link pointing to a sensitive file immediately after the check and before cp opens the file. Because cp does not open the source with O_NOFOLLOW, the open operation can follow the newly swapped symbolic link. If the race is won, the privileged cp process copies the contents of the sensitive target file into the destination, leaking data to the attacker.

How to fix it

Upgrade uutils coreutils to a version that fixes the race by avoiding path-based follow behavior or by opening files with appropriate no-follow semantics. No fixed version was provided in the input, so track the uutils coreutils project advisories, distribution security advisories, and package manager updates for the patched release. Until patched, avoid running uutils cp with elevated privileges against attacker-writable paths. Replace vulnerable workflows with safer copy logic that opens source files using O_NOFOLLOW or file-descriptor-based APIs, validates ownership and permissions of parent directories, and avoids copying from shared writable directories. Where feasible, use a non-vulnerable coreutils implementation for privileged automation, isolate untrusted file processing, and restrict local users' ability to modify paths consumed by privileged copy operations.

How to confirm the fix worked

Confirm which cp implementation is in use and whether it comes from uutils coreutils rather than another coreutils package. Inventory scripts, cron jobs, service units, build pipelines, packaging tasks, installers, and administrative automation that invoke cp on paths in shared or user-writable locations. Validate that the installed package version includes the vendor or upstream fix once available. For workflow-level validation, test that cp invoked with no-dereference intent does not copy the contents of a symlink target when a source path is swapped from a regular file to a symbolic link during execution. Also verify that privileged copy operations reject or safely handle source paths located in directories writable by less-privileged users.

Typical attack path

1. Gain local low-privileged access to a system using uutils coreutils cp.
2. Find a privileged script, service, cron job, installer, or maintenance process that invokes cp on paths inside an attacker-writable directory.
3. Create a regular source file that will pass cp's path-based symbolic-link check.
4. Run a tight loop that alternates or atomically swaps the source file with a symbolic link to a sensitive file readable by the privileged cp process.
5. Wait for the privileged cp operation to occur and win the race between metadata check and file open.
6. Read the copied output from the destination controlled by or accessible to the attacker.

How to detect it

This vulnerability does not produce a unique network signature and successful exploitation may look like normal local file-copy activity. Review endpoint telemetry, audit logs, shell history, process accounting, EDR events, and file integrity monitoring for privileged cp executions that read sensitive files or operate on source paths in user-writable directories. Linux auditd or eBPF-based telemetry is especially useful: look for cp processes running as root or a service account with source paths under shared writable locations, rapid rename/symlink activity in the same directory, and resulting output files containing data from sensitive paths. Investigate bursts of ln -s, mv, rename, or unlink operations near the time privileged cp ran. Also review access and modification times for sensitive files that should not have been copied, and search for copies of secrets or configuration content in temporary, build, upload, or user-controlled directories. Because no public exploitation or named threat actors are indicated, detection should focus on behavioral evidence rather than fixed IOCs.

What your security team should do

• Inventory systems and containers using uutils coreutils, especially where it replaces standard system coreutils.
• Prioritize review of privileged automation that runs cp over attacker-writable directories such as temporary directories, shared workspaces, upload directories, build directories, and multi-user project paths.
• Apply the upstream or distribution patch as soon as a fixed uutils coreutils version is available.
• As an interim control, replace uutils cp in privileged workflows with a safe implementation or custom copy routine that enforces no-symlink behavior at open time.
• Harden file-processing workflows by requiring trusted ownership and non-writable parent directories before privileged copy operations.
• Add audit monitoring for privileged cp executions involving world-writable or user-controlled paths.
• Treat unexpected copies of sensitive files into user-accessible locations as potential compromise and investigate immediately.