CVE-2026-35340 MEDIUM

CVE-2026-35340: uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode

Vendor Uutils
Product coreutils
Weakness CWE-253
Published April 22, 2026
Last update April 22, 2026

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

Key dates

02Disclosure timeline

April 22, 2026 CVE published
April 22, 2026 Record updated