GitHub Advisoryadvisory · crates.io

GHSA-7cr3-h577-g38j rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

MEDIUM Published 2026-07-06 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-35349
Ecosystem
crates.io
Packages
uu_rm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-59, CWE-693
Reviewed
2026-07-06

Affected packages

• crates.io uu_rm: < 0.7.0 → fixed in 0.7.0

Description

The `--preserve-root` check uses a path-string test (`path.has_root() && path.parent().is_none()`) rather than comparing device/inode. A symlink to `/` (e.g. `/tmp/rootlink -> /`) has a parent component, so it passes the check. GNU caches `/`'s dev/inode at startup and compares every traversed directory against it. Impact: `rm -rf --preserve-root` on a path that resolves through a symlink to `/` bypasses protection and can delete system directories. Recommendation: compare each entered directory's dev/inode against cached `/`. Remediation: Acknowledged by Canonical; fixed in commit 5e5968cd. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.44. Credit: Zellic._

Related

Alias · CVE (1)

  • CVE-2026-35349 A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. vulnerability

Weakness · CWE (2)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-693 Protection Mechanism Failure weakness

References