Path Traversal in yggdrasil-worker-package-manager

Executive Summary

CVE-2026-18379 is a path traversal vulnerability in the yggdrasil-worker-package-manager component. An authenticated attacker can exploit this flaw by providing a crafted repository name containing directory traversal sequences like '../' to manipulate the worker process into creating or deleting files outside the intended directory. This can lead to privilege escalation or system compromise because the worker process runs with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Monitor file operations in the /etc/yum.repos.d/ directory and system-wide file changes. Use auditd to log file creation/deletion events with commands like 'auditctl -w /etc/yum.repos.d/ -p wa -k yggdrasil-repo'. Check for unexpected .repo files outside intended directories. Deploy runtime security tools like Falco or eBPF to detect anomalous file operations involving path traversal patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to modify or delete critical system files, such as cron jobs or configuration files, by exploiting directory traversal in repository names. Since the worker process runs as root, successful exploitation could lead to full system compromise, unauthorized code execution, or denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a patched version of yggdrasil-worker-package-manager that enforces input validation. Restrict authenticated access to the message broker dispatching directives. Enable SELinux in enforcing mode and deploy EDR agents. Configure auditd to log file operations and implement file integrity monitoring to detect unauthorized changes.

Useful 0 Not Useful 0