Vulnerability · Published Apr 22, 2026 · Assigned by canonical
CVE-2026-35339uutils coreutils chmod False Success Exit Code in Recursive Mode
Medium 5.5
In plain English
A medium-severity security flaw in coreutils from Uutils. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35339 |
| Debian:13 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35339 |
| Debian:14 | rust-coreutils | 0.6.0-1 | DEBIAN-CVE-2026-35339 |
| Ubuntu:24.04:LTS | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35339 |
| Ubuntu:25.10 | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35339 |
Affected products (as reported)
Weakness: CWE-253 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/uutils/coreutils/pull/9793 patch, issue-tracking
- https://github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory