CVE-2026-35338

CVE-2026-35338 is a path traversal vulnerability in the chmod utility of uutils coreutils that undermines the --preserve-root safety mechanism designed to prevent accidental destruction of root filesystems. The flaw exists because the implementation only checks if the target path is literally "/" without canonicalizing path variants, allowing attackers to bypass this protection using alternate paths such as "/../" or symbolic links to execute recursive permission changes on the entire root filesystem. The vulnerability carries a CVSS score of 7.3 (HIGH) with a local attack vector requiring low complexity and low privilege escalation. Successful exploitation results in high impact across confidentiality, integrity, and availability, as an attacker can execute destructive operations like "chmod -R 000" that would render a system unusable by removing all file permissions across the filesystem. There is no current evidence of active exploitation in the wild, with the vulnerability absent from the Known Exploited Vulnerabilities (KEV) catalog and maintaining an inactive status on threat intelligence hot lists. The EPSS score of 0.0001 indicates this remains a low-probability target for exploitation relative to the broader CVE landscape, though the moderate FAUCET risk score of 47.0 suggests organizations running vulnerable versions of uutils coreutils should prioritize updates to patch this capability-denial vulnerability.