Pardus Software Center CVE-2026-5166

Exploitation requires the victim to actively use Pardus Software Center to fetch and process attacker-controlled content (a malicious package archive or a repository whose entries embed traversal sequences), matching the CVSS UI:R requirement - the user must install or open the crafted content for the traversal to trigger. Limiting factors: mandatory user interaction; the target must be running Pardus Software Center before 1.0.3 (1.0.2 confirmed affected); and the attacker must get their malicious package/repository in front of the user, so environments that restrict installs to signed official repositories substantially blunt the attack. No authentication of the attacker is needed (PR:N), but this is a client-side content-handling flaw rather than a directly reachable network service.

Signals here are notably in tension and should be weighed rather than driven by the headline 9.6. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a low-complexity, unauthenticated, network-delivered path traversal with total impact but requiring user interaction. Against that, EPSS is only 0.03% (10th percentile) and CISA SSVC reports Exploitation: none and Automatable: no, though Technical Impact: total agrees with the high CVSS impact metrics. There is no KEV listing and no POC signal in the data, so real-world urgency is far lower than the 9.6 suggests: the impact is severe but exploitation depends on tricking a user into consuming malicious content, is not automatable, and shows no observed activity. This is best treated as a genuine critical-impact bug to patch promptly, but not an emergency 'exploited-in-the-wild' item. Note the AV:N with UI:R combination implies delivery over a network (e.g., a malicious repository or downloaded package) followed by a local user action - verify the exact delivery path with the vendor advisory, as the network vector without server-side exposure is really a client-side content-handling flaw.

An attacker publishes or serves a crafted package or repository entry containing pathnames with '../' traversal sequences and lures a Pardus user into installing it through the Software Center. When the client processes the content it writes attacker-controlled files outside the intended directory - for example overwriting configuration or startup files - achieving code execution or system compromise. No public exploit is currently available, and success depends on the required user interaction (UI:R).