EUVD-2026-68526
GHSA-r8hh-g4qp-57p7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L confirmed by desktop GUI tool type; PR:N because the tool self-elevates; UI:R because the user must actively run and interact with the application.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.
AnalysisAI
OS command injection in Pardus Boot Repair versions 1.0.7 through before 1.0.8 allows a local attacker to execute arbitrary OS commands with the elevated privileges under which the tool operates. The vulnerability stems from improper neutralization of shell metacharacters in user-supplied input passed to OS commands within this boot repair utility developed by TÜBİTAK BİLGEM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running Pardus Boot Repair version 1.0.7. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score reflects a high-severity local vulnerability with full impact across confidentiality, integrity, and availability, though the local attack vector (AV:L) and required user interaction (UI:R) materially constrain the attack surface compared to remotely exploitable issues. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pardus Boot Repair to version 1.0.8 or later, which resolves the OS command injection flaw per the version boundary stated in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Pardus Boot Repair versions 1.0.7 or earlier and restrict execution of the tool to trusted local administrators only; implement access controls to prevent unauthorized local users from invoking it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today