What is the CVSS score of CVE-2026-5161?

CVE-2026-5161 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pardus About are affected by CVE-2026-5161?

CVE-2026-5161 affects Pardus About, the system information utility in TÜBİTAK BİLGEM's Pardus Linux distribution, allowing local attackers to redirect privileged file operations to arbitrary paths…

How to fix or mitigate CVE-2026-5161?

Within 24 hours, identify all systems running Pardus Linux before v1.2.1 and confirm Pardus About deployment across your environment. Within 7 days, implement filesystem hardening including strict ACLs on directories accessed by privileged operations, restrict user symlink creation in temporary directories, and disable Pardus About functionality if operationally feasible. Within 30 days, monitor TÜBİTAK BİLGEM's advisory channels for Pardus v1.2.1 or later release, prepare an upgrade testing plan, and validate the patched version in staging before production deployment.

Pardus About CVE-2026-5161

EUVD-2026-26236 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-04-29 TR-CERT

Information Disclosure Pardus About Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Symlink planting needs local access (AV:L) and a low-priv account (PR:L); the follow requires a race/timing and victim action so AC:H and UI:R, with full local file impact.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:50 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 14:45 euvd

EUVD-2026-26236

CVE Published

Apr 29, 2026 - 14:27 nvd

HIGH 8.8

DescriptionCVE.org

Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack.

This issue affects Pardus About: before v1.2.1.

AnalysisAI

Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.

Technical ContextAI

Pardus About is the system-information ('About') application shipped with Pardus, a Debian-based Linux distribution developed by TÜBİTAK BİLGEM Software Technologies Research Institute for Turkish public-sector use (CPE cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus_about). The root cause is CWE-59, Improper Link Resolution Before File Access ('link following'): the application accesses a file by path without verifying that the path (or an intermediate directory component) is not an attacker-controlled symbolic link. If the operation runs with elevated privileges or targets a shared/predictable location, an attacker can pre-place a symlink so the read or write is silently redirected to a sensitive target file, defeating the intended access boundary.

RemediationAI

Vendor-released patch: v1.2.1 - upgrade Pardus About to v1.2.1 or later via the standard Pardus/APT package channels, which is the primary and authoritative fix. Consult the TR-CERT advisory at https://www.usom.gov.tr/bildirim/tr-26-0131 (mirror https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131) and https://vuldb.com/vuln/360159 for vendor details. Where immediate patching is not possible, apply compensating controls specific to symlink abuse: restrict write permissions on any directory the application reads from or writes to so untrusted local users cannot pre-place symlinks (trade-off: may break workflows that rely on shared temp/config paths), ensure the application is not run with unnecessary elevated privileges, and enable the kernel's protected-symlinks hardening (fs.protected_symlinks=1, and fs.protected_hardlinks=1) which blocks the classic sticky-directory symlink-follow pattern with minimal side effects on normal desktop use.