The rm utility in Uutils coreutils fails to correctly normalize paths that contain trailing slashes, such as './' or './//'. When a user runs 'rm -rf ./', the command silently deletes all files and subdirectories in the current working directory. The error message printed is misleading, saying 'Invalid input', which can cause the user to ignore the impending loss of data. This flaw is classified as CWE-22, path traversal/validation weaknesses.

The vulnerability exists in the Uutils coreutils package. All released versions of the rm utility that have not incorporated the fix are affected. No specific version numbers are disclosed in the advisory, so any deployment of the Uutils coreutils binary that includes the unpatched rm command would be vulnerable.

The CVSS score of 5.6 indicates moderate severity, and the EPSS score is not available, providing no explicit probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. It is exploitable only by a local user who can run the rm command within a directory of interest; the attacker must have write permission to that directory. Because the deletion is recursive and the error message obfuscates file loss, the loss of data can be extensive but requires local execution.