CVE-2026-77113

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

CVSS

No CVSS.

References

Link	Resource
https://github.com/canonical/apport/pull/646
https://launchpad.net/bugs/2161697

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Salto de ruta en apport-unpack en Canonical Apport anterior a 2.36.0, 2.34.2 y 2.28.4 en Linux permite a un atacante crear o sobrescribir archivos arbitrarios con los privilegios del usuario que ejecuta mediante nombres de clave controlados por el atacante en archivos de informe de fallos.

Information

Published : 2026-08-20 23:16

Updated : 2026-10-18 20:10

NVD link : CVE-2026-77113

Mitre link : CVE-2026-77113

CVE.ORG link : CVE-2026-77113

JSON object : View

Products Affected

No product.

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-77113", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77113", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:50:19.847915Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/apport", "vendor": "Canonical", "product": "Apport", "versions": [{"status": "affected", "version": "0", "lessThan": "2.36.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.34.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.28.4", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "apport-unpack", "programFiles": ["problem_report.py"], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T23:16:28.387", "references": [{"url": "https://github.com/canonical/apport/pull/646", "source": "security@ubuntu.com"}, {"url": "https://launchpad.net/bugs/2161697", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Path traversal in apport-unpack in Canonical Apport before\u00a02.36.0,\u00a02.34.2, and\u00a02.28.4\u00a0on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files."}, {"lang": "es", "value": "Salto de ruta en apport-unpack en Canonical Apport anterior a 2.36.0, 2.34.2 y 2.28.4 en Linux permite a un atacante crear o sobrescribir archivos arbitrarios con los privilegios del usuario que ejecuta mediante nombres de clave controlados por el atacante en archivos de informe de fallos."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security@ubuntu.com"}