EUVD-2026-41552
GHSA-8725-rp9g-qx9v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged user (AV:L/PR:L) exploits a missing authz check with no interaction; argument injection into a privileged backend crosses a privilege boundary (S:C) yielding full root-level C/I/A impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection.
This issue affects pardus-software: from <= 1.0.4 before 1.0.5.
AnalysisAI
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the Pardus Linux application/software center) affects versions up to and including 1.0.4 and is fixed in 1.0.5. A low-privileged local user can abuse a missing authorization check (CWE-862) to inject attacker-controlled arguments into a privileged backend operation, and because the CVSS scope is Changed with High confidentiality, integrity, and availability impact, this realistically yields code execution or full compromise of the underlying system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running pardus-software version 1.0.4 or earlier (the Pardus software center) and a low-privileged authenticated account (CVSS PR:L), with no user interaction needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) describes a local, low-complexity attack requiring only low privileges and no user interaction, with a scope change and full High impact across confidentiality, integrity, and availability - the classic signature of local privilege escalation to root. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged user with a local shell on a Pardus workstation invokes the pardus-software backend operation that lacks an authorization check and supplies crafted input that is passed through as extra command-line arguments to the privileged package-management helper. Because the scope changes and impact is High across the board, the injected arguments cause the privileged process to execute attacker-chosen actions, escalating the user to root-level control of the machine. … |
| Remediation | Upgrade pardus-software to version 1.0.5, which is the vendor-released patch that remediates this vulnerability; on Pardus systems this is best done via the distribution's package updates (apt) so the fixed package replaces the vulnerable 1.0.4-and-earlier builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running pardus-software and document current versions via package manager queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pardus Software
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today