uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU) — GHSA-FQF6-GXHH-2XHW

Summary

`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `BackupMode::None` when only `--suffix` is given. GNU enables backup mode when `--suffix` is used alone (defaulting to existing/numbered, or `$VERSION_CONTROL`). Affects `cp`, `install`, `mv`, `ln` which share this code. ``` # uutils: no backup created $ coreutils cp --suffix=.bak src dest # dest.bak…

Timeline

Published by source

2026-07-07

Risk context

• Reported severity or threat level: high.
• Reported CVSS score: 7 out of 10.
• Review exposure for the affected product or family: rust: uucore.

Product

rust: uucore

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source

Evidence and provenance

Canonical advisory ID

GHSA-FQF6-GXHH-2XHW

Source

GitHub

Vendor

GitHub

Published by source

2026-07-07

Last source activity

2026-07-07

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.