CVE-2026-35372

CVE-2026-35372 is a logic error in the ln utility of uutils coreutils that causes it to dereference symbolic links even when the --no-dereference flag is explicitly specified. The vulnerability exists because the no-dereference functionality was only implemented when combined with the --force flag, allowing attackers to bypass the intended protection. This flaw affects the ln command-line utility across systems using the affected uutils coreutils implementation. The vulnerability carries a CVSS score of 5.0 (Medium severity) with a local attack vector requiring low complexity and low privilege level user access. While confidentiality is not impacted, the integrity impact is rated high, as an attacker could manipulate symbolic links to redirect file creation into sensitive directories. In scenarios where privileged users or system scripts utilize ln -n to update symlinks, a local attacker could exploit this to perform unauthorized file creation or cause system misconfiguration. There is currently no evidence of active exploitation, as the vulnerability is not listed in the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00019 indicates this is among the lowest probability vulnerabilities for exploitation in the wild. However, the moderate CVSS score and potential for privilege escalation scenarios warrant patching, particularly in multi-user systems or environments where symbolic link manipulation is feasible.