Pardus About EUVD-2026-26236

Exploitation requires the attacker to be able to create a symbolic link in a location that Pardus About accesses, and (per UI:R) requires user interaction - a victim launching or invoking the About application so the vulnerable file operation executes and follows the attacker's link; the impact is meaningful only when that operation runs at higher privilege than the attacker. Limiting factors: this is bounded to systems that actually run Pardus and the Pardus About utility (largely Turkish public-sector Linux deployments), it is version-limited to releases before v1.2.1, and CISA SSVC rates it non-automatable with no observed exploitation. The published AV:N (network) metric is inconsistent with a local symlink-planting prerequisite and should be confirmed with the vendor before treating this as remotely reachable.

Signals conflict and should temper the raw 8.8 score. CVSS declares AV:N/AC:L/PR:N/UI:R with full C/I/A impact, but the vulnerability class (symlink following in a local 'About' utility) and CISA SSVC (Automatable: no, Exploitation: none) point to a local, non-automatable issue rather than remote mass exploitation - the AV:N metric is questionable and should be verified with the vendor. Corroborating the lower real-world urgency: EPSS is 0.05% (14th percentile), the vulnerability is not in CISA KEV, and no public exploit is identified. SSVC does rate Technical Impact as 'total', so successful exploitation is serious where it applies, but the combination of no known exploitation, low automatability, required user interaction, and a niche product footprint makes this a moderate-priority patch item rather than an emergency, especially outside Pardus-based (largely Turkish public-sector) environments.

A local user with a normal account plants a symbolic link at a path that Pardus About will operate on, then induces the required user interaction (e.g., launching or triggering the About utility). When the application resolves the link during a privileged file read or write, the operation is redirected to a sensitive system file, letting the attacker disclose or overwrite data outside their privilege level. No public exploit is identified at time of analysis, so this reflects the vulnerability class rather than a released POC.