Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic link-following issue in the mv utility of uutils/coreutils. When moving a directory across filesystem boundaries, the utility is supposed to copy the directory contents. However, the vulnerable version of the code did not properly handle symbolic links within the directory being moved. Instead of preserving the symlink, it would follow it and copy the contents of the target of the symlink. This could lead to several security issues, including denial of service (if the symlink points to a very large directory or creates a recursive loop), or information disclosure (if a sensitive file is symlinked and then copied to a less secure location).
The patch addresses this by changing the order of operations in the copy_dir_contents_recursive function. The corrected code now checks if a file system entry is a symbolic link before it checks if it is a directory. This ensures that symbolic links are treated as such and are not expanded during the move operation. The vulnerable function is clearly copy_dir_contents_recursive as it contains the flawed logic that was corrected by the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| coreutils | rust | < 0.7.0 | 0.7.0 |
