CVE-2026-93658CWE-281

CVE-2026-93658

High · published September 18, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00139 · 3.0th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2026-09-18T19:17Z
References (7)
https://github.com/uutils/coreutils · [email protected]https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs · [email protected]https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55 · [email protected]https://github.com/uutils/coreutils/pull/13629 · [email protected]https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m · [email protected]https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid · [email protected]https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 14:23Z
    uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
    cvelistv5