Read the docs
TI-2026-85904 Aliases CVE-2026-105422GHSA-f2c6-p4f4-q5ff

Path traversal in TÜBİTAK BİLGEM pardus-boot-repair

Priority LOW 28CWE-22Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

TÜBİTAK BİLGEM pardus-boot-repair from 1.0.9 before 1.1.0 contains a path traversal flaw (CWE-22) in which pathnames are not restricted to the intended directory. An attacker with physical access and no privileges can reach files outside the restricted directory, and user interaction is required. The flaw can affect confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.

Why it matters now

EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed pardus-boot-repair (TÜBİTAK BİLGEM Software Technologies Research Institute): 1.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TÜBİTAK BİLGEM Software Technologies Research Institutepardus-boot-repair1.0.9 to before 1.1.01.1.0Patch availableCNA

Remediation

Update pardus-boot-repair to version 1.1.0 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA pardus-boot-repair (TÜBİTAK BİLGEM Software Technologies Research Institute) Fixed in 1.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair 1.1.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85906 Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repairPriority LOW 20
    Show all 2 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-105422
  2. 2026-11-06 Alias added: GHSA-f2c6-p4f4-q5ff
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-53129 Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1CRITICAL 9.1
  • TI-2026-15720 Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk CVSS 3.1HIGH 7.5
  • TI-2026-15985 OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair CVSS 3.1HIGH 7.8
  • TI-2026-83798 Privilege escalation in TÜBİTAK BİLGEM eta-register CVSS 3.1HIGH 7.8
  • TI-2026-55130 Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter CVSS 3.1HIGH 7.1
  • TI-2026-15399 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer CVSS 3.1HIGH 7.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences