Log in Start free

Vulnerability · Published Apr 22, 2026 · Assigned by canonical

CVE-2026-35345uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race

Medium 5.3

In plain English

A medium-severity security flaw in coreutils from Uutils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)<0.1%top 99.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-coreutilsno fix listedDEBIAN-CVE-2026-35345
Debian:13rust-coreutilsno fix listedDEBIAN-CVE-2026-35345
Debian:14rust-coreutils0.10.0-1DEBIAN-CVE-2026-35345
Ubuntu:24.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35345
Ubuntu:25.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35345
Ubuntu:26.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35345
Ubuntu:26.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35345

Affected products (as reported)

VendorProductVersions
Uutils coreutils see references

Weakness: CWE-367, CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References