CVE-2026-35373: ln: rejects non-UTF-8 source filenames in target-directory mode

July 6, 2026

In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.

PoC:

name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst

References

github.com/advisories/GHSA-jcjr-rh8q-7xqf
github.com/uutils/coreutils/pull/11403
github.com/uutils/coreutils/security/advisories/GHSA-jcjr-rh8q-7xqf
nvd.nist.gov/vuln/detail/CVE-2026-35373

Code Behaviors & Features

Detect and mitigate CVE-2026-35373 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →