eopkg has Path Traversal: '../filedir' vulnerability
Priority LOW 26CWE-24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be installed in the path given by `--destdir`, but on a different location on the host. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed eopkg (getsolus): 4.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getsolus | eopkg | before 4.4.0 | 4.4.0 | Patch available | CNA |
- eopkg Vendorgetsolus Affected before 4.4.0 Fixed in 4.4.0 Patch available CNA
Remediation
- Fix · CNA eopkg (getsolus) Fixed in 4.4.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-21436
References
More Getsol Eopkg vulnerabilities
- TI-2026-17322 eopkg vulnerable to package file list integrity bypass CVSS 4.0LOW 2.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences