Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. coreutils
  4. ›
  5. CVE-2026-35351

CVE-2026-35351: uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries

April 22, 2026 (updated April 29, 2026)

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller’s UID/GID rather than the source’s metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

References

  • github.com/advisories/GHSA-957r-r8gc-vv3h
  • github.com/uutils/coreutils
  • github.com/uutils/coreutils/issues/9714
  • nvd.nist.gov/vuln/detail/CVE-2026-35351

Code Behaviors & Features

Detect and mitigate CVE-2026-35351 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 0.8.0

Solution

Unfortunately, there is no solution available yet.

Impact 4.2 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-281: Improper Preservation of Permissions

Source file

cargo/coreutils/CVE-2026-35351.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:19:10 +0000.