EUVD-2026-26248Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Content is delivered over the network but a user must install it (UI:R); traversal escapes the app's directory into wider filesystem (S:C) with total impact, and no attacker auth is required (PR:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal.
This issue affects Pardus Software Center: before 1.0.3.
AnalysisAI
Path traversal (CWE-22) in TUBITAK BILGEM's Pardus Software Center before 1.0.3 lets a remote attacker craft package or repository content whose file paths escape the intended install directory, resulting in high-severity confidentiality, integrity, and availability impact with a scope change (CVSS 9.6). Exploitation requires the victim to interact (UI:R), typically by installing or opening attacker-supplied content, and there is no public exploit identified at time of analysis. EPSS is very low (0.03%, 10th percentile) and CISA SSVC records exploitation as 'none', indicating no observed activity despite the critical score.
Technical ContextAI
Pardus Software Center is the graphical application/package management front-end for Pardus, a Debian-based Linux distribution maintained by TUBITAK BILGEM (the Turkish national research institute). The flaw is CWE-22, Improper Limitation of a Pathname to a Restricted Directory: the software fails to canonicalize or constrain pathnames it processes (for example package archive member paths, download targets, or repository-supplied filenames), allowing '../' sequences to reference files outside the intended restricted directory. The CPE cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus_software_center:*:* confirms the affected component is the Software Center application itself rather than the underlying dpkg/APT stack. The CVSS scope change (S:C) indicates the traversal lets the flaw write to or read from resources managed outside the application's own security authority - consistent with a client that unpacks or places files on the wider filesystem.
RemediationAI
Upgrade Pardus Software Center to version 1.0.3 or later, which the vendor lists as the fixed release (Vendor-released patch: 1.0.3); this is the primary and complete fix. Turkish public-sector operators running Pardus should apply the update through their managed repositories and consult the TR-CERT/USOM advisory at https://www.usom.gov.tr/bildirim/tr-26-0131 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131 for distribution guidance. Until 1.0.3 is deployed, reduce exposure by installing software only from trusted, signed official Pardus repositories and avoiding manually supplied or third-party package/repository sources (the trade-off is reduced flexibility for users who rely on external repos), and restrict which users can add repositories or trigger installs so a traversal payload cannot be delivered through untrusted content.
More in Pardus Software Center
View allA path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same netw
Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged p
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today