What is the CVSS score of CVE-2026-6849?

CVE-2026-6849 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pardus My Computer are affected by CVE-2026-6849?

Pardus OS 'My Computer' file manager (versions up to 0.7.5) contains a high-severity command injection flaw (CVE-2026-6849, CVSS 8.8) permitting arbitrary operating-system command execution when…. A patch is available.

How to fix or mitigate CVE-2026-6849?

Initiate an inventory of Pardus OS systems running file-manager versions 0.7.5 or earlier within 24 hours, categorizing by operational criticality. Begin patch deployment to version 0.8.0 within 7 days, prioritizing critical systems, and complete rollout across all affected systems by 30 days. Verify successful patching through system audits and confirm all systems meet version 0.8.0 or later before closing remediation.

Pardus My Computer CVE-2026-6849

EUVD-2026-26249 HIGH

OS Command Injection (CWE-78)

2026-04-29 TR-CERT

Command Injection Pardus Os My Computer Tubitak Bilgem Software Technologies Research Institute

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Malicious content can be delivered remotely (AV:N) but requires the victim to open it (UI:R); no auth needed (PR:N) and command injection yields full user-context compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:48 vuln.today

Patch released

Apr 29, 2026 - 21:13 nvd

Patch available

Apr 29, 2026 - 17:01 EUVD

EUVD ID Assigned

Apr 29, 2026 - 15:30 euvd

EUVD-2026-26249

CVE Published

Apr 29, 2026 - 14:42 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.

This issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.

AnalysisAI

OS command injection in Pardus OS "My Computer" (versions up to and including 0.7.5, fixed in 0.8.0) lets an attacker execute arbitrary operating-system commands when a victim interacts with attacker-controlled input, inheriting the privileges of the file-manager process. Reported by Turkey's national CERT (TR-CERT) with a vendor patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.10%).

Technical ContextAI

Pardus is a Debian-based Linux distribution developed by TÜBİTAK BİLGEM, and "My Computer" is its bundled file-manager/system component (CPE cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:pardus_os_my_computer). The flaw is CWE-78 (improper neutralization of special elements used in an OS command), meaning user- or file-supplied data is passed into a shell/command interpreter without sanitizing metacharacters (e.g., ; | & $() backticks), so injected elements are executed as additional OS commands. Root cause is typically a component invoking a shell to act on filenames, paths, mount points, or device/URI handlers rather than using argument-safe process execution.

RemediationAI

Vendor-released patch: upgrade Pardus OS My Computer to version 0.8.0 or later, which addresses the command injection; all builds up to and including 0.7.5 are affected. Apply via the Pardus package repositories/system updates and consult the TR-CERT advisory at https://www.usom.gov.tr/bildirim/tr-26-0131 (mirror: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131). Until 0.8.0 can be deployed, reduce exposure by not opening untrusted files, archives, network shares, or links through the My Computer component and by restricting which untrusted file types reach it; because the trigger is user interaction, security-awareness guidance to avoid untrusted content is a meaningful interim control, though it does not eliminate the underlying flaw and should not be treated as a substitute for the patch.