CVE-2026-35363

What it actually does

The flaw is an improper input validation issue in the uutils coreutils implementation of `rm`. The utility contains safeguards that reject direct attempts to recursively remove the current or parent directory using `.` or `..`, but it does not correctly canonicalize equivalent path forms with trailing slashes such as `./` or `.///`. As a result, a command such as `rm -rf ./` can recursively delete the contents of the current working directory instead of being blocked. Confidentiality is not directly affected, but integrity is severely impacted through unintended file deletion, and availability may be degraded if application, build, source, configuration, or operational files are removed.

Why it matters to the business

This vulnerability can cause destructive local data loss when uutils coreutils is used in scripts, automation, developer workstations, CI/CD jobs, containers, or administrative shells. The most likely outcomes are accidental deletion of project directories, build artifacts, application files, configuration files, or other working data. Because exploitation requires local command execution and user interaction or a script path that invokes `rm`, broad remote compromise is unlikely; however, the operational impact can still be significant where uutils coreutils is deployed in automated workflows. EPSS is very low and the issue is not in CISA KEV, so internet-scale exploitation is not currently indicated, but organizations using uutils in build or automation environments should still prioritize validation and containment because the effect is destructive.

How an attack unfolds

An attacker or a faulty script must be able to cause the vulnerable `rm` binary from uutils coreutils to run locally with a path representing the current directory plus one or more trailing slashes. The utility rejects literal `.` and `..`, but fails to treat `./`, `.//`, or `.///` as equivalent protected current-directory references. When invoked with recursive and force options, for example `rm -rf ./`, it proceeds to remove the contents under the process's current working directory. The command may then emit a misleading `Invalid input` error, which can obscure that deletion has already occurred and delay recovery actions. In malicious scenarios, a user with local access, compromised automation account, malicious package script, poisoned build step, or social-engineered command could intentionally trigger data destruction within the directory where the command executes.

How to fix it

Upgrade uutils coreutils to a vendor or upstream release that fixes the path canonicalization and current-directory safeguard behavior when such a version is available. No fixed version was provided in the supplied advisory data, so track the upstream uutils coreutils security advisory and distribution package updates. Until a fixed build is deployed, consider replacing vulnerable uutils `rm` with a non-affected implementation, such as the platform vendor's patched package or GNU coreutils where appropriate. For high-risk automation, add wrapper safeguards that reject recursive deletion targets resolving to the current directory or parent directory, including forms with trailing slashes. Review CI/CD pipelines, package scripts, container images, and administrative scripts for dangerous patterns such as `rm -rf ./`, `rm -rf .//`, or `rm -rf .///`. Ensure backups, version control, artifact repositories, and filesystem snapshots are available for directories where destructive automation runs.

How to confirm the fix worked

Confirm which `rm` implementation is in use with commands such as `rm --version`, package manager inventory, container image manifests, and software bill of materials data. Validate remediation in a disposable test directory only: create a temporary directory with test files and verify that the patched or replacement `rm` refuses `rm -rf .`, `rm -rf ./`, `rm -rf .//`, and `rm -rf .///` without deleting directory contents. Search scripts, CI/CD definitions, shell histories, package hooks, and container build files for recursive deletion commands targeting current-directory equivalents. Confirm that vulnerable uutils coreutils packages are no longer present in host images, containers, developer tooling, and automation runners. Where package fixed versions become available, verify that installed versions meet or exceed the fixed release specified by the upstream project or operating system vendor.

Typical attack path

1. Identify a system, container, build job, script, or user environment that uses the uutils coreutils implementation of `rm` rather than a non-affected implementation.
2. Obtain a way to execute local commands or influence shell scripts, package hooks, CI/CD steps, maintenance jobs, or user commands.
3. Ensure the working directory contains files of value, such as source code, build outputs, configuration, application data, or operational assets.
4. Invoke the vulnerable utility with recursive deletion against an equivalent current-directory path with trailing slashes, such as `rm -rf ./` or `rm -rf .///`.
5. The vulnerable utility bypasses the intended safeguard and recursively deletes the contents of the current directory.
6. The misleading error output may cause operators to misinterpret the event, delaying restoration from backups, filesystem snapshots, version control, or artifact repositories.

How to detect it

Detection should focus on evidence of prior local execution of the vulnerable command pattern and signs of unexpected recursive deletion. Review shell history files, audit logs, endpoint telemetry, CI/CD job logs, container build logs, package manager hook logs, cron/systemd job output, terminal session recordings, and EDR process execution data for `rm` commands using recursive flags against `./`, `.//`, `.///`, or other current-directory equivalents with trailing slashes. Correlate those executions with bursts of file deletion events, sudden workspace cleanup, missing source/build/configuration files, or application failures immediately afterward. On Linux systems with auditd or EDR file telemetry, look for process name `rm` performing large numbers of unlink/rmdir operations in a single working directory. In automation platforms, search job logs for both the dangerous command and the misleading `Invalid input` output near failed builds or missing artifacts. Because this is a local destructive issue rather than a network-exposed exploit, there are no reliable network IOCs; host, script, and job-log evidence are the primary sources.

• rm -rf ./
• rm -rf .//
• rm -rf .///
• rm -fr ./
• rm -fr .//
• rm -fr .///
• rm --recursive --force ./
• rm --force --recursive ./
• Invalid input
• process.name:rm AND process.args:"-rf" AND process.args:"./"
• process.name:rm AND process.args:"-fr" AND process.args:"./"
• execve("rm", ["rm", "-rf", "./"]
• execve("rm", ["rm", "-rf", ".///"]

What your security team should do

• Inventory systems, containers, build runners, developer images, and automation environments that use uutils coreutils, specifically the uutils implementation of `rm`.
• Prioritize remediation for CI/CD runners, release engineering systems, package build environments, container images, and administrative automation where recursive deletion commands are common.
• Replace or upgrade the affected utility when a fixed package is available; until then, use a known-safe `rm` implementation or a defensive wrapper in high-risk workflows.
• Search code repositories, pipeline definitions, shell scripts, Dockerfiles, Makefiles, package scripts, and operational runbooks for `rm -rf ./`, `rm -rf .//`, `rm -rf .///`, and related current-directory deletion patterns.
• Add preventive controls in automation, such as shell safety checks, dry-run protections, protected working directories, immutable artifacts, and least-privilege execution accounts.
• Ensure rapid recovery options exist for critical working directories, including tested backups, snapshots, source control, and rebuildable artifacts.
• Monitor for suspicious or accidental invocations of `rm` with recursive flags and current-directory path variants, especially in privileged shells and automation logs.
• Treat events containing misleading `Invalid input` output from `rm` together with sudden file deletion as potential evidence of this issue.