Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-35351
PUBLISHED
More InfoOfficial Page
Assigner-canonical
Assigner Org ID-cc1ad9ee-3454-478d-9317-d3e869d708bc
View Known Exploited Vulnerability (KEV) details
Published At-22 Apr, 2026 | 16:08
Updated At-22 Apr, 2026 | 18:05
Rejected At-
▼CVE Numbering Authority (CNA)
uutils coreutils mv Silent Ownership Loss in Cross-Device Operations

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

Affected Products
Vendor
Uutils
Product
coreutils
Collection URL
https://github.com/uutils
Package Name
coreutils
Repo
https://github.com/uutils/coreutils
Platforms
  • Linux
  • Unix
  • macOS
Default Status
affected
Problem Types
TypeCWE IDDescription
CWECWE-281CWE-281: Improper Preservation of Permissions
Type: CWE
CWE ID: CWE-281
Description: CWE-281: Improper Preservation of Permissions
Metrics
VersionBase scoreBase severityVector
3.14.2MEDIUM
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 4.2
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-122CAPEC-122: Privilege Abuse
CAPEC ID: CAPEC-122
Description: CAPEC-122: Privilege Abuse
Solutions

Configurations

Workarounds

Exploits

Credits

finder
Zellic
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/uutils/coreutils/issues/9714
issue-tracking
Hyperlink: https://github.com/uutils/coreutils/issues/9714
Resource:
issue-tracking
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/uutils/coreutils/issues/9714
exploit
Hyperlink: https://github.com/uutils/coreutils/issues/9714
Resource:
exploit
Details not found