CVE-2026-35375

uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding

Published Apr 22, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.

Analysis

Technical impact

A logic error in the split utility of uutils coreutils causes corruption of output filenames when non‑UTF‑8 prefixes or suffixes are supplied. The code uses to_string_lossy(), converting invalid byte sequences into the Unicode replacement character U+FFFD, which differs from GNU split that preserves raw bytes. This results in files being written with incorrect names, potentially leading to filename collisions, broken scripts, or misdirected output data.

Affected Systems

The uutils coreutils split command is affected. No explicit affected–version information is provided; however, the vulnerability was fixed in the 0.8.0 release as indicated by the advisory links.

Risk and Exploitability

The CVSS score is 3.3, indicating a low severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local and that an attacker would need write access to the directory where split is executed. Exploitation would result only in data integrity problems rather than broader system compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Uutils

coreutils

unaffected

Version	Status	Constraints
`0`	affected	< 0.8.0

Configuration 1 [-]

cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*

No data.

Vendor Product Versions

Uutils

Coreutils

Version	Status	Scheme	Platform
`[0,0.8.0)`	affected	generic	['linux', 'unix', 'macos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade uutils coreutils to version 0.8.0 or later to apply the authoritative fix.
Until the update is applied, avoid using split with non‑UTF‑8 prefixes or suffixes; ensure that all inputs to split are valid UTF‑8 to prevent lossy filename encoding.
Implement validation of filename characters in scripts that call split to detect and correct invalid names before processing the output.

Generated by OpenCVE AI on April 27, 2026 at 08:36 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vx9m-xjwf-8cqm	uutils coreutils has an Improper Handling of Unicode Encoding Issue

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.143% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/uutils/coreutils/pull/11397
https://github.com/uutils/coreutils/releases/tag/0.8.0

History

May 4, 2026 7:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:uutils:coreutils::::::rust::*

Apr 27, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uutils Uutils coreutils
Vendors & Products		Uutils Uutils coreutils

Apr 22, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 22, 2026 4:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.
Title		uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding
Weaknesses		CWE-176
References		https://github.com/uutils/coreutils/pull/11397 https://github.com/uutils/coreutils/releases/tag/0.8.0
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`