# CVE-2026-35351

> Vulnerability · severity: **MEDIUM** (CVSS 4.2).

## Description

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

## Key facts

- **CVE ID:** CVE-2026-35351
- **Published:** 2026-04-22
- **CVSS severity:** MEDIUM
- **CVSS base score:** 4.2
- **CWE codes:** CWE-281

## Affected products

- `uutils:coreutils`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-35351

## Citation

> AI Analytics. CVE-2026-35351. Retrieved 2026-08-18 from https://api.ai-analytics.org/cve/CVE-2026-35351. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*