Pardus My Computer EUVD-2026-26249

Exploitation requires user interaction (CVSS UI:R): a victim running the affected Pardus OS My Computer component (<=0.7.5) must open or act on attacker-controlled input containing OS-command metacharacters - such as a maliciously named file, path, archive entry, mount point, or URI processed by the file manager. No authentication is required against the target (PR:N), and attack complexity is low (AC:L). Limiting factors: the mandatory user action, the need for the vulnerable component/version to be present and used, and that impact is bounded by the privileges of the file-manager process rather than automatic root. The AV:N rating suggests remote delivery of the malicious content, but the exploit only fires upon local user interaction with it.

Signals are mixed and point to a genuine-but-not-urgent priority. The CVSS 3.1 base is 8.8 (High) driven by AV:N/AC:L/PR:N with total C/I/A impact, but exploitation is gated by UI:R (a user must open or act on the malicious input). CISA's SSVC frames it as Exploitation: none, Automatable: no, Technical Impact: total - consistent with full compromise per successful attack but no observed or scalable exploitation. EPSS is low (0.10%, 28th percentile) and there is no KEV listing and no known POC, so real-world exploitation likelihood is currently low. Note a plausible inconsistency: AV:N implies network delivery, but a desktop file-manager command-injection more realistically depends on the victim locally opening a crafted file/archive/link, so the effective vector may be closer to local-with-social-engineering - verify delivery path with the vendor advisory.

An attacker crafts a file, filename, archive entry, or path/URI containing shell metacharacters and delivers it to a Pardus user (e.g., via download, email, or a removable/mounted volume). When the victim opens or otherwise interacts with the item in "My Computer," the embedded command is passed to a shell and executed with the user's privileges, giving the attacker code execution. No public POC has been identified, and success depends on the required user interaction (UI:R).