CVE-2026-35363

Executive Summary

CVE-2026-35363 is a path traversal vulnerability in the rm utility of the uutils coreutils project (a Rust-based reimplementation of GNU coreutils). The flaw allows an attacker to bypass the built-in safeguard that prevents deletion of the current directory (.) or parent directory (..). By using paths with trailing slashes (e.g., ./ or .///), the safeguard is bypassed, and the command rm -rf ./ silently deletes all contents of the current directory. The utility also outputs a misleading "Invalid input" error, further obscuring the data loss. This vulnerability has a CVSS score of 5.6 (Medium) and is particularly dangerous in automated scripts or CI/CD pipelines where rm -rf ./ might be used.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via crates.io (Rust package registry) and is also available as a system package on some Linux distributions (e.g., Fedora, Arch Linux). Users who have installed uutils coreutils via cargo install coreutils or via a distribution package manager are affected. The package is a drop-in replacement for GNU coreutils, so it may be used in Docker images, CI/CD pipelines, or embedded systems. The fix is available in version 0.0.30.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to execute the rm command.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs user-level access.
• User Interaction (UI): None (N) – No user interaction needed beyond executing the command.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – No data exfiltration.
• Integrity (I): High (H) – All files in the current directory are deleted.
• Availability (A): High (H) – Data loss leads to denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires local access. It is most dangerous in shared environments, automated scripts, or when combined with social engineering.

Deep Dive & Mechanics

The rm utility in uutils coreutils includes a safeguard that checks if the target path is exactly . or .. and refuses to delete them. However, the safeguard does not normalize paths before comparison. When a path like ./ or ./// is provided, the operating system treats it as equivalent to ., but the string comparison in the code fails to match the literal . or .. strings.

The vulnerable code path:

1. User runs rm -rf ./
2. The utility parses the argument ./
3. The safeguard checks if the argument equals . or .. – it does not, so it passes.
4. The rm utility proceeds to recursively delete all files and directories in the current directory.
5. After deletion, the utility prints a misleading "Invalid input" error (likely from a different code path), confusing the user.

The fix involves canonicalizing the path (e.g., using std::fs::canonicalize or a custom normalization function) before performing the safeguard check.

Vulnerable vs. Patched Code

Vulnerable (simplified Rust pseudocode):

fn remove(path: &str) -> Result<()> {
    if path == "." || path == ".." {
        return Err("Refusing to remove current or parent directory");
    }
    // Proceed with deletion
    std::fs::remove_dir_all(path)?;
    Ok(())
}

Patched (simplified Rust pseudocode):

fn remove(path: &str) -> Result<()> {
    let canonical = std::path::Path::new(path)
        .canonicalize()
        .unwrap_or_else(|_| path.into());
    let canonical_str = canonical.to_string_lossy();
    if canonical_str == "." || canonical_str == ".." {
        return Err("Refusing to remove current or parent directory");
    }
    // Proceed with deletion
    std::fs::remove_dir_all(path)?;
    Ok(())
}

The patch normalizes the path using canonicalize() before the safeguard check, ensuring that ./ and ./// are correctly identified as the current directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable uutils coreutils (version < 0.0.30) on a test Linux system.
2. Create a test directory with sample files: mkdir /tmp/test && cd /tmp/test && touch file1.txt file2.txt
3. Execute the exploit: rm -rf ./
4. Observe that all files in /tmp/test are deleted, and the misleading "Invalid input" error is printed.

Exploit Command:

# In a directory with important files, run:
rm -rf ./

Automated Exploit (Bash script):

#!/bin/bash
# Exploit CVE-2026-35363 - Delete all files in current directory
echo "Exploiting CVE-2026-35363..."
rm -rf ./
echo "All files deleted. Check 'ls' to confirm."

Blue Team

Detection:

• Monitor for rm commands with arguments containing trailing slashes (e.g., ./, .///).
• Alert on rm -rf commands executed in sensitive directories (e.g., /home, /tmp, /var/www).
• Look for the "Invalid input" error message in system logs immediately after a rm command.

Prevention:

• Update uutils coreutils to version 0.0.30 or later.
• Use GNU coreutils instead of uutils in production environments.
• Implement command whitelisting or use safe-rm wrappers.
• Enable filesystem snapshots (e.g., LVM, ZFS) for quick recovery.

Indicators of Compromise (IOCs)

• Command Line: rm -rf ./ or rm -rf ./// (with any number of trailing slashes)
• Log Entry: "Invalid input" error message in syslog or application logs immediately after a rm command.
• File System: Sudden disappearance of all files in a directory without a corresponding rm command targeting specific files.
• Process Tree: rm process with arguments containing ./ or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2026_35363_rm_trailing_slash {
    meta:
        description = "Detects rm commands with trailing slashes that bypass safeguard"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35363"
    strings:
        $cmd1 = "rm -rf ./" ascii wide nocase
        $cmd2 = "rm -rf .///" ascii wide nocase
        $cmd3 = /rm -rf \.\/{2,}/ ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-35363 - rm Utility Trailing Slash Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of rm with trailing slashes to bypass current directory protection
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35363
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rm'
        CommandLine|contains: './'
    condition: selection
falsepositives:
    - Legitimate use of relative paths with trailing slashes (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35363 - rm Trailing Slash Exploit"; content:"rm -rf ./"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update uutils coreutils to version 0.0.30 or later. Run cargo install coreutils --version 0.0.30 or use your package manager to update.
2. Workaround: Use GNU coreutils instead of uutils. If uutils is required, avoid using rm -rf ./ in scripts; use rm -rf * or specify absolute paths.
3. Detection: Implement the YARA, Sigma, and Suricata rules above to detect exploitation attempts.
4. Backup: Ensure regular backups are taken and test recovery procedures.
5. Monitoring: Monitor for the "Invalid input" error message in logs and investigate any rm commands with trailing slashes.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 0E29D8A3D99C529464B16274] */}