Skip to main content

Canonical Apport CVE-2026-77113

| EUVDEUVD-2026-63758 MEDIUM
Relative Path Traversal (CWE-23)
2026-08-20 canonical GHSA-m4rr-rf2f-g267
Path Traversal Canonical Apport
6.7
CVSS 4.0 · Vendor: canonical
Share

Severity by source

Vendor (canonical) PRIMARY
6.7 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Local delivery and explicit user execution of apport-unpack required (UI:R, AV:L); no privileges needed to craft the report (PR:N); impact is integrity-only, no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 20, 2026 - 23:23 vuln.today
Analysis Generated
Aug 20, 2026 - 23:23 vuln.today
CVE Published
Aug 20, 2026 - 22:32 cve.org
MEDIUM 6.7

DescriptionCVE.org

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

AnalysisAI

Path traversal in the apport-unpack utility of Canonical Apport enables arbitrary file creation and overwrite by exploiting attacker-controlled key names embedded in crafted crash report files. Affected versions span all Apport releases before 2.28.4, 2.34.2, and 2.36.0 - software that ships by default with Ubuntu desktop and server editions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft .crash report with path-traversal key names
Delivery
Deliver malicious report to target system
Exploit
Induce victim or pipeline to invoke apport-unpack
Execution
Trigger traversal during key-to-filename mapping
Impact
Write attacker-controlled content to arbitrary filesystem path
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target user or an automated process execute `apport-unpack` against an attacker-supplied `.crash` report file in which one or more key names contain path traversal sequences (forward slashes forming relative paths such as `../../`). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.7 with vector AV:L/AC:L/AT:N/PR:N/UI:A accurately reflects the attack characteristics: local delivery of a malicious crash report with required active user interaction meaningfully constrains exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a `.crash` report file containing key names with embedded path traversal sequences such as `../../.config/autostart/persistence.desktop` and delivers it to a developer's Ubuntu workstation via a shared network directory, a compromised package, or social engineering. The developer or an automated crash-processing pipeline invokes `apport-unpack` against the file, causing Apport to write attacker-controlled content to the traversed path with the developer's filesystem privileges, potentially establishing persistence or overwriting sensitive configuration files.
Remediation Upgrade Apport to version 2.36.0, 2.34.2 (for the 2.34.x branch), or 2.28.4 (for the 2.28.x branch) by applying the upstream fix from GitHub PR https://github.com/canonical/apport/pull/646. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apport

View all
CVE-2015-1318 HIGH POC
7.2 Apr 17

The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a craf
CVE-2016-9949 HIGH POC
7.8 Dec 17

An issue was discovered in Apport before 2.20.4. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2016-9951 MEDIUM POC
6.5 Dec 17

An issue was discovered in Apport before 2.20.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
CVE-2016-9950 HIGH POC
7.8 Dec 17

An issue was discovered in Apport before 2.20.4. Rated high severity (CVSS 7.8), this vulnerability is no authentication
CVE-2021-25684 HIGH POC
7.8 Jun 11

It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. Rat
CVE-2021-25683 HIGH POC
7.8 Jun 11

It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from t
CVE-2021-25682 HIGH POC
7.8 Jun 11

It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from

CVE-2015-1338 HIGH POC
7.2 Oct 01

kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly ga
CVE-2021-32557 HIGH POC
7.1 Jun 12

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symli
CVE-2019-7307 HIGH POC
7.0 Aug 29

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubu
CVE-2021-3710 MEDIUM POC
5.5 Oct 01

An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). Rated medium se
CVE-2021-3709 MEDIUM POC
5.5 Oct 01

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9
CVE-2022-1373 HIGH POC
7.2

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-77113 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy