0xroi/cve-2026-77113Technical write-up for CVE-2026-77113, a path traversal in Apport's apport-unpack where crafted report keys escape the extraction directory and write files outside the destination.
apport-unpack Path Traversal (CVE-2026-77113)A path traversal issue in Apport's apport-unpack allowed attacker-controlled report keys to escape the specified extraction directory.
A crafted report containing:
../escaped: owned-by-report
could cause apport-unpack to write the value to a path outside the requested destination directory.
The vulnerable flow was essentially:
Untrusted report
↓
ProblemReport.load()
↓
Attacker-controlled key
↓
os.path.join(destination, key)
↓
File write outside destination
ProblemReport.__setitem__() already restricted normal report keys, but report loading did not consistently enforce the same validation.