CVE-2026-35340CWE-253

uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode

Medium · published April 22, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Weakness
CWE-253 · Incorrect Check of Function Return Value
Published
2026-04-22T16:07Z
EPSS history
Timeline
  • 22 APR 16:07Z
    uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode
    cvelistv5