Canonical Apport EUVD-2026-63758

Exploitation requires that the target user or an automated process execute apport-unpack against an attacker-supplied .crash report file in which one or more key names contain path traversal sequences (forward slashes forming relative paths such as ../../). The attacker must deliver the crafted file to the target system before apport-unpack is invoked - delivery vectors include social engineering, shared crash-report directories, or network-accessible aggregation pipelines. The CVSS 4.0 vector specifies active user interaction (UI:A), meaning passive file presence is insufficient; explicit invocation of apport-unpack on the malicious report is required. No privileges are needed to craft the report (PR:N). Exploitation is bounded by the privilege level of the user running apport-unpack - root access is not granted unless the tool itself is executed by a privileged account. Systems where Apport is disabled, not installed, or where apport-unpack is never invoked on externally sourced files are not at practical risk.

The CVSS 4.0 score of 6.7 with vector AV:L/AC:L/AT:N/PR:N/UI:A accurately reflects the attack characteristics: local delivery of a malicious crash report with required active user interaction meaningfully constrains exploitation. The local attack vector (AV:L) and mandatory user interaction (UI:A) prevent fully remote or passive exploitation - an attacker must both place the crafted file on the target system and trigger apport-unpack execution against it. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation forecasting; this gap should be noted. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified at time of analysis. Despite the moderate score, the impact class - arbitrary file write at the privilege level of the executing user - is serious: on CI/CD systems, developer workstations, or crash aggregation pipelines where apport-unpack runs under a privileged account, this becomes a meaningful privilege-escalation stepping stone. Risk is materially lower on headless production servers where Apport is typically disabled or not installed. No conflicting signals between the CVSS vector and the technical description were identified.

An attacker crafts a .crash report file containing key names with embedded path traversal sequences such as ../../.config/autostart/persistence.desktop and delivers it to a developer's Ubuntu workstation via a shared network directory, a compromised package, or social engineering. The developer or an automated crash-processing pipeline invokes apport-unpack against the file, causing Apport to write attacker-controlled content to the traversed path with the developer's filesystem privileges, potentially establishing persistence or overwriting sensitive configuration files.