CVE-2026-18806

7.1 HIGH

Published 2026-08-04 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows external control of file names or paths in pardus-image-writer before version 0.9.0, potentially leading to removal of important client functionality.
Exploitability: Exploitation requires access to modify file names or paths; preconditions include having the ability to manipulate input data.
Blast radius: If exploited, this could significantly impact client systems by removing critical functionalities.
Prioritized remediation: Update to pardus-image-writer version 0.9.0 or later immediately.

path-traversalfunctionality-removalpatch-available

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-73

All references

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0740

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.