CVE-2026-35342Disclosure(uutils / coreutils)

LOWCVSS 3.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

uutils CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/uutils/coreutils/pull/10566

Other references

https://github.com/uutils/coreutils/releases/tag/0.6.0

Weakness type (CWE)

CWE-377

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

coreutils

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

uutils

Products

coreutils

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-35342

Full discourse1 post

CVE@CVEnew169d
Disclosure
CVE-2026-35342 The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an em… https://www.cve.org/CVERecord?id=CVE-2026-35342
Post summary
The post announces the CVE-2026-35342 issue, detailing how the mktemp utility in uutils coreutils mishandles an empty TMPDIR environment variable, but does not provide a PoC, patch, or evidence of active exploitation.
00000168
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	uutils	coreutils	-	rust	-

Explore more

Back to dashboard uutils CVEs coreutils vulnerabilities