https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:32:21 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-35363 <p>A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading &#39;Invalid input&#39; error, which may cause users to miss the critical window for data recovery.</p> <p>A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading &#39;Invalid input&#39; error, which may cause users to miss the critical window for data recovery.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-35363 https://vulnerability.circl.lu/vuln/ghsa-89p7-7cq3-hhr2 <p><strong>Affected:</strong> crates.io: uu_rm</p> <p>`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent_directory` only matches `.`/`..` (and `/.`/`/..`), not `./` or `../`. So `rm -rf ./` recursively deletes the directory&#39;s contents and then prints a misleading `cannot remove &#39;./&#39;: Invalid input`.</p> <p>**Impact:** all files/subdirectories in the current directory are silently deleted; the misleading error makes users miss the recovery window. Recommendation: handle trailing-slash variants in `path_is_current_or_parent_directory`.</p> <p>**Remediation:** Acknowledged by Canonical; fixed in commit d0e5af23.</p> <p>--- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.60. Credit: Zellic._</p> <p>_Upstream tracking issue: https://github.com/uutils/coreutils/issues/9749 · CVE-2026-35363_</p> <p><strong>Affected:</strong> crates.io: uu_rm</p> <p>`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent_directory` only matches `.`/`..` (and `/.`/`/..`), not `./` or `../`. So `rm -rf ./` recursively deletes the directory&#39;s contents and then prints a misleading `cannot remove &#39;./&#39;: Invalid input`.</p> <p>**Impact:** all files/subdirectories in the current directory are silently deleted; the misleading error makes users miss the recovery window. Recommendation: handle trailing-slash variants in `path_is_current_or_parent_directory`.</p> <p>**Remediation:** Acknowledged by Canonical; fixed in commit d0e5af23.</p> <p>--- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.60. Credit: Zellic._</p> <p>_Upstream tracking issue: https://github.com/uutils/coreutils/issues/9749 · CVE-2026-35363_</p> https://vulnerability.circl.lu/vuln/ghsa-89p7-7cq3-hhr2 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-35363 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils, Ubuntu:26.04:LTS: rust-coreutils</p> <p>A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading &#39;Invalid input&#39; error, which may cause users to miss the critical window for data recovery.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils, Ubuntu:26.04:LTS: rust-coreutils</p> <p>A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading &#39;Invalid input&#39; error, which may cause users to miss the critical window for data recovery.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-35363