A flaw in the uutils coreutils tail utility causes information disclosure when the --follow=name option is used. The tool keeps monitoring a file path even after it is replaced by a symbolic link. Consequently, if an attacker replaces a log file with a symlink to a protected file such as /etc/shadow, tail will output the contents of that file. This allows a local attacker who can write to the monitored directory to exfiltrate sensitive data that otherwise would require privileged access.

The vulnerability affects the tail command distributed by the Uutils coreutils project. No specific affected versions are disclosed. Anyone using uutils coreutils and running tail with the --follow=name flag in a privileged context is potentially impacted.

The CVSS score of 5.3 reflects a moderate risk. EPSS information is not available, so the likely exploitation probability cannot be quantified, but the flaw remains unlisted in CISA KEV catalog. The attack requires local write access to a directory that is monitored by a privileged tail instance. Once those conditions exist, the attacker can create a symlink to a sensitive file and trigger data disclosure. The risk is heightened when the victim runs tail as a privileged user monitoring log directories of sensitive system files.