CVE-2026-35360
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
28/100
Published: 2026-04-22
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
High
A:
High
Description
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
Weakness Classification (1)
References & Advisories (1)
Exploit
Issue Tracking
Vendor Advisory