GitHub Advisoryadvisory · crates.io

GHSA-jcjr-rh8q-7xqf ln: rejects non-UTF-8 source filenames in target-directory mode

LOW Published 2026-07-06 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-35373
Ecosystem
crates.io
Packages
uu_ln
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-176
Reviewed
2026-07-06

Affected packages

• crates.io uu_ln: < 0.6.0 → fixed in 0.6.0

Description

In target-directory forms (`ln SOURCE... DIRECTORY`), `ln` rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems. PoC: ``` name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty ``` --- _Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

Related

Alias · CVE (1)

  • CVE-2026-35373 A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when… vulnerability

Weakness · CWE (1)

  • CWE-176 Improper Handling of Unicode Encoding weakness

References