What is the CVSS score of CVE-2026-18806?

CVE-2026-18806 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of pardus-image-writer are affected by CVE-2026-18806?

pardus-image-writer (Turkish Pardus Linux distribution tool) contains a path traversal vulnerability (CVE-2026-18806, CVSS 7.1) that allows authenticated local users to delete critical files and…. A patch is available.

How to fix or mitigate CVE-2026-18806?

Within 24 hours, inventory all systems running pardus-image-writer versions prior to 1.0.4, with priority on Pardus Linux deployments in government and critical infrastructure. Within 7 days, test and stage the deployment of pardus-image-writer version 1.0.4 or later to non-production environments, validating functionality with the new version. Within 30 days, complete rollout to all production systems and confirm successful deployment via package verification; if immediate patching is not feasible, restrict local user account privileges and monitor for suspicious file deletion activity.

pardus-image-writer CVE-2026-18806

EUVD-2026-52668 HIGH

External Control of File Name or Path (CWE-73)

2026-08-04 iletisim@usom.gov.tr

GHSA-55j4-vcvp-5mxf

Information Disclosure

7.1

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.1 HIGH

Local-only exploitation via crafted path input requires a standard user account (PR:L, AV:L); file overwrite/delete yields high integrity and availability impact with no confirmed confidentiality exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 04, 2026 - 14:16 EUVD

Analysis Generated

Aug 04, 2026 - 13:31 vuln.today

CVE Published

Aug 04, 2026 - 13:17 nvd

HIGH 7.1

DescriptionCVE.org

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.

This issue affects pardus-image-writer: before 1.0.4.

AnalysisAI

pardus-image-writer before 1.0.4, developed by TÜBİTAK BİLGEM Software Technologies Research Institute for Turkey's national Pardus Linux distribution, permits external control of file name or path (CWE-73), enabling a locally authenticated attacker to redirect file operations outside their intended scope and remove important client functionality. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 7.1) confirms that standard user privileges and no interaction from other users are required, with high integrity and availability impact but no confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis; this is a Turkish CERT (USOM)-reported vulnerability with a confirmed fix at version 1.0.4.

Technical ContextAI

CWE-73 (External Control of File Name or Path) occurs when an application accepts user-controlled input that specifies or influences the path of a file used in a subsequent operation without adequate sanitization or restriction. pardus-image-writer is a disk/USB image writing utility bundled with Pardus Linux, the national Linux distribution of Turkey maintained by TÜBİTAK BİLGEM (Scientific and Technological Research Council of Turkey, Informatics and Information Security Research Center). In this context, the application likely accepts a target or source file path parameter that is not properly validated, allowing an attacker to craft a malicious path - potentially using traversal sequences or absolute paths - to redirect write or delete operations to files outside the intended working directory. The local attack vector (AV:L) and low-privilege requirement (PR:L) indicate the vulnerable code path is reachable by any standard system user, not just administrators. No CPE strings were provided in the input data.

RemediationAI

Upgrade pardus-image-writer to version 1.0.4 or later, which resolves this path control vulnerability per the vendor advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0740. If an immediate upgrade is not feasible, restrict execution of pardus-image-writer to only trusted, vetted users via filesystem permissions or sudo policy, since exploitation requires at minimum a standard local user account (PR:L). Additionally, consider monitoring for unexpected file write or delete operations in sensitive directories using auditd or similar integrity monitoring, which would detect exploitation attempts without blocking legitimate use. Restricting the application's file system access via AppArmor or SELinux profiles could also limit the blast radius of exploitation, though profile creation requires familiarity with the application's expected file access patterns.