CVE-2026-35372

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the ln utility allows it to dereference a symbolic link target even when the --no-dereference (or -n) flag is used. The utility only honored the no-dereference intent if the --force mode was also enabled. This causes ln to follow a symbolic link pointing to a directory and create new links inside that target directory rather than treating the symbolic link as the destination. A local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.