osmancanvural/cve-2026-21436Proof-of-concept exploit for CVE-2026-21436, demonstrating path traversal in Solus OS eopkg package manager allowing arbitrary file write during package installation.
eopkg <= 4.3.4, the Solus OS package manager, writes files containing absolute paths in package contents directly to the specified directory during the installation of packages with the .eopkg extension.
Even if the --destdir parameter, used to install the package to a specific directory, is used, this restriction can be bypassed thanks to the ../ (traversal) characters in the package, allowing attacker-crafted files to be written to any directory on the system. Since the eopkg tool runs with root privileges during package installation, it is also possible to overwrite existing files on the system.
The cause of the vulnerability is that eopkg does not use the filter parameter with Python's .extract() method when extracting packages, nor does it validate file paths in any way.
$ git clone https://github.com/osmancanvural/CVE-2026-21436/
$ cd CVE-2026-21436
.eopkg file you want to modify.install.tar.xz archive inside it into the tarcontent folder.$ python3 archiveCreator.py
malicious-install.tar.xz file to install.tar.xz and replace the file in the original package with it./tmp/hello.txt file has been created.Note: You can edit the archiveCreator.py file and the tarcontent folder to change the target directory and file content.