CVE-2026-18806
Received Received - Intake

External File Name Control in Pardus Image Writer

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18806
EUVD
EUVD-2026-52668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tubitak pardus-image-writer to 1.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to manipulate file paths or names in TÜBİTAK BİLGEM pardus-image-writer before version 1.0.4. This could lead to unauthorized removal of critical client functionality.

Impact Analysis

An attacker could exploit this to delete important files or disable essential features in the pardus-image-writer tool, potentially disrupting system operations or data integrity.

Mitigation Strategies

Update pardus-image-writer to version 1.0.4 or later to address the vulnerability. Remove or restrict access to vulnerable versions if updates are not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart