CVE-2026-35373

Summary

ln: rejects non-UTF-8 source filenames in target-directory mode

Severity

low

CVSS

3.3

EPSS

0.1% (p2)

CWE

CWE-176

Also known as

GHSA-jcjr-rh8q-7xqf, GHSA-xh5h-p8c5-4w4x

Published

2026-07-06

Updated

2026-07-06

Advisory details

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst
# GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty

Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

References

• https://github.com/advisories/GHSA-jcjr-rh8q-7xqf
• https://github.com/uutils/coreutils/security/advisories/GHSA-jcjr-rh8q-7xqf
• https://nvd.nist.gov/vuln/detail/CVE-2026-35373
• https://github.com/uutils/coreutils/pull/11403

Related advisories

• CVE-2026-59890 — medium · PyPI/setuptools

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity