CVE-2026-18806

Received Received - Intake

External File Name Control in Pardus Image Writer

Publication date: 2026-08-04

Last updated on: 2026-08-10

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-10

Generated

2026-08-24

AI Q&A

2026-08-04

EPSS Evaluated

2026-08-23

NVD

CVE-2026-18806

EUVD

EUVD-2026-52668

Affected Vendors & Products

Vendor	Product	Version / Range
tubitak_bilgem	pardus_image_writer	to 1.0.4 (exc)
tubitak	pardus-image-writer	to 1.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to manipulate file paths or names in TÜBİTAK BİLGEM pardus-image-writer before version 1.0.4. This could lead to unauthorized removal of critical client functionality.

Detection Guidance

This vulnerability involves external control of file names or paths in pardus-image-writer before version 1.0.4. To detect it, check the installed version of pardus-image-writer using package managers like 'dpkg -l pardus-image-writer' or 'rpm -qa | grep pardus-image-writer'. If the version is below 1.0.4, the system is vulnerable.

Impact Analysis

An attacker could exploit this to delete important files or disable essential features in the pardus-image-writer tool, potentially disrupting system operations or data integrity.

Compliance Impact

The vulnerability allows external control of file names or paths, which could lead to unauthorized file manipulation. This may impact compliance with standards like GDPR or HIPAA by potentially enabling unauthorized access or modification of sensitive data, though specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Update pardus-image-writer to version 1.0.4 or later to address the vulnerability. Remove or restrict access to vulnerable versions if updates are not immediately possible.

Hi! I’m here to help you understand CVE-2026-18806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70