CVE-2026-35365

CVE-2026-35365 is a vulnerability in the mv utility within uutils coreutils that improperly handles symbolic links when moving directory trees across filesystem boundaries. Rather than preserving symlinks as intended, the implementation expands them and copies the linked targets as actual files or directories to the destination, potentially causing resource exhaustion, unintended duplication of sensitive data, or infinite recursion when symlink loops are present. The vulnerability has a CVSS score of 6.6 (Medium) with a local attack vector requiring low privileges and no user interaction. The primary impact is integrity-focused, with moderate confidentiality and availability implications. An authenticated local attacker could exploit this to duplicate sensitive data to unintended locations or exhaust system resources through symlink expansion of large external directories. This vulnerability currently shows no active exploitation in the wild. The EPSS score of 0.00013 indicates minimal real-world exploitation likelihood relative to other CVEs, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Community attention remains low with the FAUCET Risk Score of 36.0/100, suggesting limited widespread concern at this time.