The recursive mode of chmod in uutils coreutils incorrectly sets the command’s exit status based solely on the last file processed. If any preceding file triggers an error such as "Operation not permitted", the utility still returns 0, signaling success. Scripts that rely on that status flag may continue with flawed permissions on sensitive files, allowing misconfigured security settings. This flaw is an example of CWE‑253, Wrong Value Used for Comparison.

The vulnerability affects uutils coreutils, specifically versions before the 0.6.0 release that contains the fix. Any environment that uses uutils coreutils to set file permissions recursively is potentially impacted.

The CVSS score of 5.5 indicates moderate severity. No EPSS score is reported, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires local access to the target system to invoke chmod in recursive mode. An attacker could run chmod -R on a directory, cause scripts to proceed under a false sense of success, and thereby leave sensitive files with incorrect or overly restrictive permissions. The primary risk is permission misconfiguration that could enable privilege escalation or accidental data exposure.