CVE-2026-77113
published 2026-08-20CVE-2026-77113: Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with…
PriorityP431medium6.7CVSS 4.0
AVLACLATNPRNUIAVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.24%
14.9th percentile
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | apport | < 2.36.0 | 2.36.0 |
| canonical | apport | < 2.34.2 | 2.34.2 |
| canonical | apport | < 2.28.4 | 2.28.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via a
ghsa_unreviewed·2026-08-21
CVE-2026-77113 [MEDIUM] CWE-23 Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via a
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.
VulDB
Canonical Apport up to 2.28.3/2.34.1/2.35.x apport-unpack path traversal (EUVD-2026-63758)
vuldb·2026-08-21·CVSS 6.7
CVE-2026-77113 [MEDIUM] Canonical Apport up to 2.28.3/2.34.1/2.35.x apport-unpack path traversal (EUVD-2026-63758)
A vulnerability marked as problematic has been reported in Canonical Apport up to 2.28.3/2.34.1/2.35.x. This impacts an unknown function of the component apport-unpack. This manipulation causes path traversal.
This vulnerability is registered as CVE-2026-77113. The attack needs to be launched locally. No exploit is available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-20
Published