CVE-2026-35345

A vulnerability in the tail utility of uutils coreutils allows exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting its contents.

An attacker can exploit this flaw to read confidential files accessible to the victim by replacing the monitored file with a symbolic link pointing to another file.

Immediately update the uutils coreutils package to a version that fixes this vulnerability. Until patched, avoid using the --follow=name option in production environments.