CVE-2026-5166

Deeper analysis

CVE-2026-5166 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified under CWE-22 as a Path Traversal issue, affecting the Pardus Software Center developed by TUBITAK BILGEM Software Technologies Research Institute. This flaw impacts versions of Pardus Software Center prior to 1.0.3. The vulnerability has a CVSS v3.1 base score of 9.6, reflecting its critical severity due to network accessibility, low attack complexity, no required privileges, user interaction dependency, high scope change, and high impacts on confidentiality, integrity, and availability.

A remote attacker with no privileges can exploit this vulnerability by tricking a user into performing an action, such as interacting with a maliciously crafted input or file, leading to path traversal. Successful exploitation allows the attacker to access restricted directories, potentially resulting in high-impact data exposure, modification, or disruption across the affected scope.

The Turkish National Cyber Incident Response Center (USOM) has issued an advisory on this vulnerability, available at https://www.usom.gov.tr/bildirim/tr-26-0131, which security practitioners should consult for detailed mitigation guidance. Updating to Pardus Software Center version 1.0.3 or later addresses the issue in affected systems.