EUVD-2026-76125
GHSA-5v68-pwx6-vvhc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local utility requires low-privilege shell access (PR:L, AV:L); no complexity or interaction barriers; full system impact via elevated process privileges.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: before 1.0.8.
AnalysisAI
OS command injection in TUBITAK BILGEM's Pardus Boot Repair allows a local low-privileged user to execute arbitrary OS commands, likely resulting in full system compromise. The vulnerability (CWE-78) affects all versions prior to 1.0.8 of this boot repair utility for the Pardus Linux distribution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local shell account on a Pardus Linux system with the vulnerable version of Pardus Boot Repair installed (before 1.0.8). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting a local attack requiring only low-privilege credentials with no user interaction and no elevated attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pardus Boot Repair to version 1.0.8 or later, which resolves the command injection flaw per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1081. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Pardus Boot Repair versions prior to 1.0.8 and immediately restrict executable permissions on the boot repair tool to administrative accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today