CVE-2026-109518
Received Received - Intake

APT Package Install Path Traversal in Debian Ubuntu

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Canonical Ltd.

Description
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-109518
EUVD
EUVD-2026-116969

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-62 The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an on-path attacker to manipulate HTTP traffic between an APT client and an archive server during package installation. By exploiting hard link reuse and redirecting downloads, the attacker can trick the client into installing a malicious unverified package, leading to remote code execution with root privileges.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system with root privileges. This means they could take full control of your machine, install additional malware, steal data, or disrupt operations.

Mitigation Strategies

Set Acquire::Retries to 0 in /etc/apt/apt.conf to disable retries and prevent the vulnerability from being triggered. This stops the client from retrying downloads after redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...