Debusine CVE-2026-11853

The mergeuploads task must be active and processing attacker-supplied .dsc or .changes manifest files on the target Debusine instance. The CVSS vector PR:N indicates no authentication is enforced at the parsing layer, but practical exploitation requires the ability to submit package artifacts to the Debusine pipeline - access that may be restricted by deployment policy even if not enforced by the software itself. Exploitation is limited to the privilege level of the worker user account; files accessible only to root or other users are not reachable. The vulnerability affects only the manifest file parsing path and does not impact other Debusine task types. Non-default or absent mergeuploads task configuration would prevent exploitation.

CVSS 6.5 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects that this is network-reachable without authentication, but the confidentiality and integrity impact is partial and scope is unchanged - meaning blast radius is limited to the worker process's own privilege level. EPSS of 0.02% at the 4th percentile is notably low, consistent with a niche infrastructure tool used primarily by Debian derivative maintainers rather than a widely deployed internet-facing product. No CISA KEV listing and no public exploit code identified at time of analysis further reduce urgency. The most realistic threat actor is a malicious or compromised package submitter within a Debusine pipeline, not an arbitrary internet attacker - the CVSS PR:N rating reflects the lack of enforced authentication at the parsing layer, but practical exploitation requires access to submit packages to the instance. Overall, this is a genuine medium-severity issue warranting patching but not emergency response outside active Debusine deployments.

An attacker with the ability to submit packages to a Debusine instance crafts a .dsc or .changes manifest file embedding path traversal sequences or absolute paths pointing to sensitive files (e.g., SSH authorized_keys, cron jobs, or service configuration files). When the mergeuploads task processes the artifact on the worker, it follows the attacker-supplied path and creates a symbolic link, silently redirecting a worker-accessible file to an attacker-controlled location - enabling either data disclosure (if the symlink is later read) or file overwrite (if subsequently written). No public proof-of-concept code has been identified, but the attack primitive is straightforward given the description.