{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35345", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-04-02T12:58:56.087Z", "datePublished": "2026-04-22T16:07:49.191Z", "dateUpdated": "2026-04-22T18:13:19.881Z"}, "containers": {"cna": {"title": "uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race", "affected": [{"vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "collectionURL": "https://github.com/uutils", "packageName": "coreutils", "repo": "https://github.com/uutils/coreutils", "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition", "type": "CWE"}, {"lang": "en", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-27", "descriptions": [{"lang": "en", "value": "CAPEC-27: Leveraging Race Conditions via Symbolic Links"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}], "references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Zellic", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:07:49.191Z"}}, "adp": [{"references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:13:16.337487Z", "id": "CVE-2026-35345", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:13:19.881Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}], "id": "CVE-2026-35345", "lastModified": "2026-04-22T17:16:36.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.2, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2026-04-22T17:16:36.627", "references": [{"source": "security@ubuntu.com", "url": "https://github.com/uutils/coreutils/issues/10328"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T18:15:58.568688+00:00", "value": {"mitigation_remediation": ["Update to the latest version of uutils coreutils where the race condition is fixed.", "Restrict write permissions on log directories that are monitored by tail so that only trusted users can alter files in those paths.", "Avoid using the --follow=name option with privileged instances of tail; instead use safer monitoring methods or disable the option entirely."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure via Symlink Race"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the tail command distributed by the Uutils coreutils project. No specific affected versions are disclosed. Anyone using uutils coreutils and running tail with the --follow=name flag in a privileged context is potentially impacted.", "description_and_impact": "A flaw in the uutils coreutils tail utility causes information disclosure when the --follow=name option is used. The tool keeps monitoring a file path even after it is replaced by a symbolic link. Consequently, if an attacker replaces a log file with a symlink to a protected file such as /etc/shadow, tail will output the contents of that file. This allows a local attacker who can write to the monitored directory to exfiltrate sensitive data that otherwise would require privileged access.", "risk_and_exploitability": "The CVSS score of 5.3 reflects a moderate risk. EPSS information is not available, so the likely exploitation probability cannot be quantified, but the flaw remains unlisted in CISA KEV catalog. The attack requires local write access to a directory that is monitored by a privileged tail instance. Once those conditions exist, the attacker can create a symlink to a sensitive file and trigger data disclosure. The risk is heightened when the victim runs tail as a privileged user monitoring log directories of sensitive system files."}}}}, "created": "2026-04-22T18:30:23.750421+00:00", "updated": "2026-04-22T18:30:23.750451+00:00", "vendors": []}