CVE-2026-35345
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
- CVSS 3.1
- 5.3
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N - EPSS
- 0.10% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-59, CWE-367
- Published
- Modified
- Record from
- the NVD, synced
Affected
- uutils:coreutils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xf75-659h-cgg5 | crates.io | coreutils | <=0.8.0 | no fix published |