CVE-2026-35350CWE-281

uutils coreutils cp Unexpected Privileged Executable Creation with -p

Medium · published April 22, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.6th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2026-04-22T16:08Z
EPSS history
Timeline
  • 22 APR 16:08Z
    uutils coreutils cp Unexpected Privileged Executable Creation with -p
    cvelistv5