CVE-2026-35360
MediumSummary
The touch utility in uutils coreutils is vulnerable to a TOCTOU race condition during file creation. After identifying a missing path, the utility later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file.
Risk Assessment
The risk involves an attacker potentially replacing the file in the time window between check and creation, leading to unauthorized access or data corruption.
Recommendation
It is recommended to update uutils coreutils to the latest version containing a fix for the TOCTOU race condition. Consider using file locking mechanisms as well.
Original NVD description (English source)
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to creat