CVE-2026-35365: Uu mv Remote Code Execution Vulnerability

MODERATE
Advisory Identifier: GHSA-h444-6j9x-p8vh
Share
CVSS 6.6
CWE-400 CWE-59
Published
Advisory Summary

CVE-2026-35365 is a MODERATE (CVSS 6.6) remote code execution vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Uu mv libraries in the crates.io ecosystem. The issue involves symlinks expanded during cross-device move (resource exhaustion / data duplication). Remediation is available by upgrading affected packages to version 0.7.0.

CVE-2026-35365 at a Glance

CVE Identifier CVE-2026-35365
GHSA Identifier GHSA-h444-6j9x-p8vh
Severity MODERATE
CVSS v3.1 Base Score 6.6
CWE Classification CWE-400: Uncontrolled Resource Consumption
Affected Product Uu mv
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 6.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity High (I:H)
Availability Low (A:L)

How to Fix CVE-2026-35365

To remediate this vulnerability, upgrade all affected Uu mv dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

uu_mv fixed: 0.7.0 
Upgrade uu_mv to 0.7.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for uu_mv

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-35365, inspect your project dependencies for Uu mv:

inspect dependencies for uu_mv

Analyze the terminal output to locate any version of Uu mv in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.7.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Uu mv, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a `etc_link -> /etc` inside the source becomes a full copy of `/etc` at the destination. **Impact:** (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via `symlink_metadata()` and recreate with `read_link()`/`symlink()`; add loop detection. **Remediation:** Acknowledged by Canonical; fixed in commit 9654e4ab. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.63. Credit: Zellic._

CVE-2026-35365 Affected Uu mv Versions

1 component(s)
Fixed Versions:
0.7.0
Product / Package Ecosystem Affected Versions Fixed Version
uu_mv
 crates.io
< 0.7.0
0.7.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/uutils/coreutils/security/advisories/GHSA-h444-6j9x-p8vh
NVD — CVE-2026-35365 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35365
Uu mv Source Repository REPOSITORY
https://github.com/uutils/coreutils/pull/10546
Security Fix Commit FIX COMMIT
https://github.com/uutils/coreutils/commit/9654e4abaf24449ef2279e9a16963edb5c8b8fef
Uu mv Source Repository REPOSITORY
https://github.com/uutils/coreutils
Uu mv Release RELEASE
https://github.com/uutils/coreutils/releases/tag/0.7.0

Frequently Asked Questions

What is CVE-2026-35365?
CVE-2026-35365 is a security vulnerability in Uu mv involving symlinks expanded during cross-device move (resource exhaustion / data duplication) under CWE-400: Uncontrolled Resource Consumption.
Which Uu mv versions are affected?
Affected versions include releases prior to 0.7.0 across affected packages: uu_mv.
What version fixes CVE-2026-35365?
Upgrading to 0.7.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is uu_mv affected?
Yes, uu_mv is affected in releases prior to 0.7.0. Upgrade your dependency to 0.7.0 or later.
What is the CVSS score of CVE-2026-35365?
CVE-2026-35365 has a CVSS v3.1 base score of 6.6 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L.
What CWE is associated with CVE-2026-35365?
CVE-2026-35365 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).
How can I check crates.io dependencies for CVE-2026-35365?
Run the dependency tree command: 'inspect dependencies for uu_mv'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h444-6j9x-p8vh",
  "modified" : "2026-07-06T20:24:53Z",
  "published" : "2026-07-06T20:24:53Z",
  "aliases" : [ "CVE-2026-35365" ],
  "summary" : "mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)",
  "details" : "When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a `etc_link -> /etc` inside the source becomes a full copy of `/etc` at the destination.\n\n**Impact:** (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via `symlink_metadata()` and recreate with `read_link()`/`symlink()`; add loop detection.\n\n**Remediation:** Acknowledged by Canonical; fixed in commit 9654e4ab.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.63. Credit: Zellic._",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "uu_mv"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/uutils/coreutils/security/advisories/GHSA-h444-6j9x-p8vh"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35365"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/uutils/coreutils/pull/10546"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/uutils/coreutils/commit/9654e4abaf24449ef2279e9a16963edb5c8b8fef"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/uutils/coreutils"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/uutils/coreutils/releases/tag/0.7.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-59" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-06T20:24:53Z",
    "nvd_published_at" : null
  }
}