CVE-2026-35342
Uutils Coreutils ≤ 0.6.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-35342 is a low-severity Insecure Temporary File (CWE-377) vulnerability in Uutils Coreutils. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24971
Vulnerability Data
The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path.…
more
This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure temp file creation in CWD due to empty TMPDIR mishandling directly enables unauthorized local access to temporary data.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of environment variable inputs such as TMPDIR before use in temporary file operations, preventing the empty-string path from being accepted.
Limits privileges of processes using mktemp so that even if files land in the CWD the exposure or modification surface remains minimal.
Enforces secure baseline settings for TMPDIR and temporary-directory handling, ensuring the utility never receives an empty value that triggers CWD fallback.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding insecure temp-file creation patterns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect insecure temporary files but does not prevent their creation.
Secure development life cycle mandates secure handling of temporary files during design and coding.
Application security requirements can specify secure temporary-file creation and access controls.
Secure system architecture principles discourage insecure temporary-file patterns but do not directly address them.
Secure coding standards explicitly require safe temporary-file APIs and permissions.
Information deletion policies may cover secure removal of temporary files after use.