CVE-2026-93658
uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
- State
- Published
- Severity
- 7.3 High
- Published
- Sep 18, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 18, 2026
Description
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-281 Improper Preservation of Permissions
Affected Products
| Product | Versions |
|---|---|
coreutilsuutils |
|
References
- GitHub Security Advisory (GHSA-cgg3-923w-v53m)vendor-advisory
- Pull Request #13629patchissue-tracking
- Patch Commitpatch
- Vulnerable install.rs at 0.9.0technical-description
- https://github.com/uutils/coreutilsproduct
- VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuidthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.