The safe_traversal module in uutils coreutils is designed to guard against Time‑of‑Check to Time‑of‑Use (TOCTOU) symlink races by using file‑descriptor‑relative system calls; however, the protection is hard‑coded to activate only on Linux. On macOS, FreeBSD and other Unix‑like systems the guard is bypassed, leaving directory traversal operations susceptible to a symlink race. This flaw falls under CWE‑367. While it does not directly enable code execution or privilege escalation, an attacker can replace a target file with a malicious symlink between the check and use phases, allowing unauthorized modification, deletion, or injection of files and potentially exposing sensitive data or causing denial of service.

uutils coreutils is an open‑source Rust implementation of GNU Coreutils. The safe_traversal module that protects against TOCTOU symlink races works only on Linux. On macOS, FreeBSD, and other Unix‑like systems the module falls back to non‑protected logic, exposing directory traversal operations to symlink race conditions. All releases of uutils coreutils before 0.6.0 exhibit this flaw on those platforms; 0.6.0 and later restore protection. The affected software is deployed on any Unix‑like host that runs the vulnerable command‑line utilities from uutils, which may include servers, build environments, or end‑user systems.

The CVSS score of 3.6 indicates low to moderate severity. The EPSS score of <1% denotes a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no confirmed widespread exploitation is reported. Exploitation would require the attacker to influence the file system at the time the vulnerable command runs, such as substituting a target file with a malicious symlink during the race window. This could allow unauthorized modification, deletion, or injection of files, potentially exposing sensitive data or causing denial of service. The most plausible attack vector is local or remote‑directed, but the need for precise timing and the low EPSS score reduce the practical risk.