chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)GHSA-4c7q-4928-8445
HIGHFix: uutils/coreutils#10033GHSA-4c7q-4928-8445 is a high-severity (CVSS 7.3) Path Traversal vulnerability in uu_chmod. A fix is available for uu_chmod — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-4c7q-4928-8445.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
uu_chmodReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Chmoder::chmod() only compares the literal argument against Path::new("/"), so the --preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../.
if self.recursive && self.preserve_root && file == Path::new("/") {
return Err(ChmodError::PreserveRoot("/".to_string()).into());
}
PoC — recursively chmods the entire filesystem to 000 despite --preserve-root:
chmod -R --preserve-root 000 /../ -v
Impact: --preserve-root is the documented safeguard against destructive recursive operations on /. Bypassing it allows chmod -R to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.
Remediation: Acknowledged by Canonical; fixed in commit 413055b3.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.1. Credit: Zellic.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | uu_chmod | all versions | 0.6.0cargo update -p uu_chmod --precise 0.6.0 |
Affected Products
coreutilsuutilsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for uu_chmod, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update uu_chmod to 0.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4c7q-4928-8445 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-4c7q-4928-8445 in your dependencies?
Find it across crates.io, including transitive dependencies.