CVE-2026-35351
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
28/100
Published: 2026-04-22
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
Low
I:
Low
A:
Low
Description
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
Weakness Classification (1)
References & Advisories (1)
Exploit
Issue Tracking
Vendor Advisory