Skip to content

ln: --no-dereference (-n) bypass

Low
sylvestre published GHSA-rfg5-2j48-mvp7 Jul 29, 2026

Package

cargo uu_ln (Rust)

Affected versions

< 0.8.0

Patched versions

0.8.0

Description

A logic error in ln lets it dereference a symbolic-link target even when --no-dereference/-n is explicitly given — the no-dereference intent was only honored when --force was also enabled. ln then follows a symlink pointing to a directory and creates links inside that target directory instead of operating on the symlink itself.


Zellic private finding (zellic-ext/coreutils-private PR #114). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Severity

Low

CVE ID

CVE-2026-35372

Weaknesses

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. Learn more on MITRE.