The mv utility in uutils coreutils incorrectly expands symbolic links when moving directories across filesystem boundaries, instead of preserving them. This behavior can cause disk space exhaustion or overly long execution when symlinks point to large external directories, duplicate sensitive data into unintended locations, or trigger infinite recursion due to symlink loops. The vulnerability is classified as CWE‑59 and results in denial of service and potential data leakage. The likely attack vector is that an attacker controls a source directory containing such symlinks and uses mv to move it, either manually or via a malicious script.

The affected product is Uutils coreutils; specific version information is not provided. Any installation of this utility that exhibits the described behavior may be vulnerable.

The CVSS score of 6.6 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known large‑scale exploitation yet. Nonetheless, a local user with the ability to arrange a symlink‑heavy directory tree can exploit the flaw to exhaust disk resources or create redundant copies of data. The impact is confined to the host where mv is executed, but can cause significant resource depletion and inadvertent data exposure.