CVE-2026-35363
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
26/100
Published: 2026-04-22
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Required
S:
Unchanged
C:
None
I:
High
A:
Low
Description
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
Weakness Classification (1)
References & Advisories (1)
Exploit
Issue Tracking
Vendor Advisory