Описание
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
Ссылки
- ExploitIssue TrackingVendor Advisory
Уязвимые конфигурации
EPSS
5.6 Medium
CVSS3
Дефекты
Связанные уязвимости
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
A vulnerability in the rm utility of uutils coreutils allows the bypas ...
rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection
EPSS
5.6 Medium
CVSS3