CVE-2026-93658 (GCVE-0-2026-93658)
Vulnerability from cvelistv5
Published
2026-09-18 14:23
Modified
2026-09-18 16:48
Severity ?
7.3 (High) - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
VLAI Severity ?
EPSS score ?
CWE
- CWE-281 - Improper Preservation of Permissions
Summary
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
References
| URL | Tags | |
|---|---|---|
|
|
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93658",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T16:45:19.868483Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:48:03.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io",
"defaultStatus": "unaffected",
"packageName": "coreutils",
"packageURL": "pkg:cargo/coreutils",
"platforms": [
"Linux",
"Unix",
"macOS"
],
"product": "coreutils",
"repo": "https://github.com/uutils/coreutils",
"vendor": "uutils",
"versions": [
{
"lessThan": "0.10.0",
"status": "affected",
"version": "0.0.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.10.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.10.0",
"versionStartIncluding": "0.0.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Firas (thesmartshadow)"
}
],
"datePublic": "2026-09-16T18:21:36.000Z",
"descriptions": [
{
"lang": "en",
"value": "uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:23:20.877Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cgg3-923w-v53m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m"
},
{
"name": "Pull Request #13629",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/uutils/coreutils/pull/13629"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55"
},
{
"name": "Vulnerable install.rs at 0.9.0",
"tags": [
"technical-description"
],
"url": "https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs"
},
{
"tags": [
"product"
],
"url": "https://github.com/uutils/coreutils"
},
{
"name": "VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid"
}
],
"title": "uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93658",
"datePublished": "2026-09-18T14:23:20.877Z",
"dateReserved": "2026-09-18T13:30:25.933Z",
"dateUpdated": "2026-09-18T16:48:03.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-93658\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-18T16:45:19.868483Z\"}}}], \"references\": [{\"url\": \"https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-18T16:47:56.616Z\"}}], \"cna\": {\"title\": \"uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Ali Firas (thesmartshadow)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 7.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"repo\": \"https://github.com/uutils/coreutils\", \"vendor\": \"uutils\", \"product\": \"coreutils\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.18\", \"lessThan\": \"0.10.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"0.10.0\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\", \"Unix\", \"macOS\"], \"packageURL\": \"pkg:cargo/coreutils\", \"packageName\": \"coreutils\", \"collectionURL\": \"https://crates.io\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-09-16T18:21:36.000Z\", \"references\": [{\"url\": \"https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m\", \"name\": \"GitHub Security Advisory (GHSA-cgg3-923w-v53m)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/uutils/coreutils/pull/13629\", \"name\": \"Pull Request #13629\", \"tags\": [\"patch\", \"issue-tracking\"]}, {\"url\": \"https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55\", \"name\": \"Patch Commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs\", \"name\": \"Vulnerable install.rs at 0.9.0\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/uutils/coreutils\", \"tags\": [\"product\"]}, {\"url\": \"https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid\", \"name\": \"VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-281\", \"description\": \"Improper Preservation of Permissions\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.10.0\", \"versionStartIncluding\": \"0.0.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-09-18T14:23:20.877Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-93658\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-18T16:48:03.334Z\", \"dateReserved\": \"2026-09-18T13:30:25.933Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-09-18T14:23:20.877Z\", \"assignerShortName\": \"VulnCheck\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…