CVE-2026-77113

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77113", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-08-20T11:53:23.292Z", "datePublished": "2026-08-20T22:32:51.447Z", "dateUpdated": "2026-08-21T20:08:37.866Z"}, "containers": {"cna": {"title": "Path Traversal Vulnerability in apport-unpack", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "Canonical", "product": "Apport", "platforms": ["Linux"], "packageName": "apport-unpack", "repo": "https://github.com/canonical/apport", "programFiles": ["problem_report.py"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.36.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.34.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.28.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.36.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.34.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.28.4"}]}]}], "descriptions": [{"lang": "en", "value": "Path traversal in apport-unpack in Canonical Apport before\u00a02.36.0,\u00a02.34.2, and\u00a02.28.4\u00a0on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files."}], "references": [{"url": "https://launchpad.net/bugs/2161697", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/canonical/apport/pull/646", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Sakib Sarkar (0xROI)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-20T22:32:51.447Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77113", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:50:19.847915Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T20:08:37.866Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77113", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:50:19.847915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T20:06:22.658Z"}}], "cna": {"title": "Path Traversal Vulnerability in apport-unpack", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Sakib Sarkar (0xROI)"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/canonical/apport", "vendor": "Canonical", "product": "Apport", "versions": [{"status": "affected", "version": "0", "lessThan": "2.36.0", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.34.2", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.28.4", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "apport-unpack", "programFiles": ["problem_report.py"], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2161697", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/canonical/apport/pull/646", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Path traversal in apport-unpack in Canonical Apport before\u00a02.36.0,\u00a02.34.2, and\u00a02.28.4\u00a0on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative path traversal"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.36.0", "versionStartIncluding": "0"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.34.2", "versionStartIncluding": "0"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:linux:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.28.4", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-08-20T22:32:51.447Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77113", "state": "PUBLISHED", "dateUpdated": "2026-08-21T20:08:37.866Z", "dateReserved": "2026-08-20T11:53:23.292Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-08-20T22:32:51.447Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "apport-unpack", "platforms": ["Linux"], "product": "Apport", "programFiles": ["problem_report.py"], "repo": "https://github.com/canonical/apport", "vendor": "Canonical", "versions": [{"lessThan": "2.36.0", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.34.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.28.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal in apport-unpack in Canonical Apport before\u00a02.36.0,\u00a02.34.2, and\u00a02.28.4\u00a0on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files."}, {"lang": "es", "value": "Salto de ruta en apport-unpack en Canonical Apport anterior a 2.36.0, 2.34.2 y 2.28.4 en Linux permite a un atacante crear o sobrescribir archivos arbitrarios con los privilegios del usuario que ejecuta mediante nombres de clave controlados por el atacante en archivos de informe de fallos."}], "id": "CVE-2026-77113", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77113", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:50:19.847915Z", "version": "2.0.3"}}]}, "published": "2026-08-20T23:16:28.387", "references": [{"source": "security@ubuntu.com", "url": "https://github.com/canonical/apport/pull/646"}, {"source": "security@ubuntu.com", "url": "https://launchpad.net/bugs/2161697"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.36.0)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.34.2)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.28.4)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apport", "source": "cna", "vendor": "Canonical"}, "product": "apport", "vendor": "canonical"}], "created": "2026-08-20T23:15:05.194312+00:00", "updated": "2026-08-21T01:30:05.626112+00:00", "vendors": ["canonical", "canonical$PRODUCT$apport"]}