add uu_chmod vulnerability CVE-2026-35338

crates/uu_chmod/RUSTSEC-0000-0000.md

@@ -0,0 +1,28 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "uu_chmod"
+date = "2026-04-22"
+url = "https://github.com/uutils/coreutils/pull/10033"
+# See https://docs.rs/rustsec/latest/rustsec/advisory/enum.Category.html
+cvss = "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+keywords = ["filesystem"]
+aliases = ["CVE-2026-35338"]
+
+[affected]
+
+[versions]
+patched = [">= 0.6.0"]
+```
+
+# Bypass the --preserve-root safety mechanism
+
+A vulnerability in the chmod utility of uutils coreutils allows users to
+bypass the --preserve-root safety mechanism. The implementation only
+validates if the target path is literally / and does not canonicalize the
+path.
+
+An attacker or accidental user can use path variants such as /../ or
+symbolic links to execute destructive recursive operations (e.g.,
+chmod -R 000) on the entire root filesystem, leading to system-wide
+permission loss and potential complete system breakdown.