Bug 2460817 (CVE-2026-35363) - CVE-2026-35363 rust-coreutils: rm: safeguard bypass via improper path normalization
Summary: CVE-2026-35363 rust-coreutils: rm: safeguard bypass via improper path normali...
Keywords:
Status: NEW
Alias: CVE-2026-35363
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2461196 2461197
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-22 17:04 UTC by OSIDB Bzimport
Modified: 2026-04-24 19:04 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-22 17:04:23 UTC
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.


Note You need to log in before you can comment on or make changes to this bug.