Loading story…
TUBITAK BILGEM's Pardus Software Center was disclosed with two high-severity vulnerabilities affecting versions prior to 1.0.3, including a privilege-management flaw tracked as CVE-2026-5141 and a path traversal issue tracked as CVE-2026-5166. The first bug was described as improper access control, incorrect privilege assignment, and improper privilege management, creating a condition that could allow hijacking of a privileged process; the affected range was later clarified as versions from 1.0.2 before 1.0.3.
The second flaw, CVE-2026-5166, was classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and affects Pardus Software Center versions before 1.0.3. Both CVEs carry high-impact CVSS v3.1 ratings with vectors indicating low attack complexity and no required privileges, while requiring user interaction, and both reference advisories published by USOM, including TR-26-0131 for the path traversal vulnerability.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry documented a path traversal vulnerability in Pardus Software Center caused by improper restriction of pathnames to a limited directory. The flaw affected versions before 1.0.3 and was assigned a high-severity CVSS v3.1 score.
A CVE entry was published for an improper privilege management and access control flaw in Pardus Software Center that could allow hijacking of a privileged process. The vulnerability affected version 1.0.2 before 1.0.3, with the affected range clarified in a later record modification.
USOM published advisory TR-26-0131 describing a path traversal flaw in TUBITAK BILGEM's Pardus Software Center affecting versions before 1.0.3. The issue was later tracked as CVE-2026-5166.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-5140**, a critical local privilege escalation chain in Pardus Linux that lets any unprivileged local user gain **root** access without authentication through the `pardus-update` package. The flaw carries a **CVSS v3.1 score of 9.3** and was identified by security researcher **Çağrı Eser (`0xc4gr1`)**. The issue combines three weaknesses: an overly permissive **Polkit** policy, a **CRLF injection** flaw in `SystemSettingsWrite.py`, and an **untrusted search path** issue in `AutoAptUpgrade.py`. Attackers can exploit the chain by injecting a malicious APT source path, causing the system to install a crafted Debian package with elevated privileges, and then obtaining a root shell by setting the **SUID** bit on `/bin/bash`. The exposure is particularly serious because Pardus Linux, maintained by **TÜBİTAK**, is widely deployed across Turkish government, education, and enterprise environments, especially on shared or multi-user systems. Recommended mitigations include tightening Polkit rules to require administrator authentication, sanitizing carriage return and newline characters in user input, and restricting APT source paths to trusted directories.
Jun 29, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026
MeWare Software Development Inc.'s **PDKS** platform was disclosed with two high-severity vulnerabilities affecting versions from `V16.20200313` before `VMYR_3.5.2025117`. **CVE-2026-7399** is an insecure direct object reference (**IDOR**) issue mapped to `CWE-639` that allows authorization bypass through a user-controlled key, enabling attackers with low privileges to abuse access rights and expose or alter sensitive data. The flaw carries a CVSS v3.1 vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating network-reachable exploitation with low attack complexity and high impact on confidentiality and integrity. A second flaw, **CVE-2026-7402**, affects the same product range and stems from improper rate limiting, tracked as `CWE-799`. The vulnerability allows flooding attacks against PDKS and is rated with the CVSS v3.1 vector `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`, reflecting high impact on integrity and availability. Both issues were referenced in advisories published through **USOM**, pointing organizations using vulnerable PDKS releases to update to a fixed version at or beyond `VMYR_3.5.2025117`.
Jun 29, 2026