The mv utility in Uutils coreutils does not preserve file ownership when moving files across filesystem boundaries. Instead of maintaining the source file’s UID/GID, the copy‑and‑delete fallback creates the destination file under the caller’s credentials. This violates the desired security property of ownership consistency, which can expose data to unintended users or deny legitimate owners access to their files. The flaw is classified as CWE-281, an improper handling of discretionary access control.

The vulnerability affects the Uutils coreutils package. No specific version numbers are listed; any installation of the mv command within this distribution is potentially vulnerable.

The CVSS score of 4.2 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the known likelihood of exploitation is unclear, but cross‑filesystem operations are common during backups and migrations, increasing the risk surface for users who run mv with elevated privileges or under workarounds. An attacker or automated backup process could change the perceived ownership of critical files, potentially turning data unreachable or exposing it to privileged users. The attack vector is local to the host, requiring the ability to execute mv commands and thereby only mitigated by restricting privileged users or applying the official fix.