yggdrasil-worker-package-manager: Path traversal (CVE-2026-18379)
The yggdrasil-worker-package-manager is vulnerable to path traversal via unsanitized repository names, allowing an authenticated attacker to perform arbitrary file modifications and potentially achieve privilege escalation.
CVE search metadata
CVE search record: CVE-2026-18379. Severity: high. CVSS: 8.8. KEV: no. Product: yggdrasil-worker-package-manager. Brief: yggdrasil-worker-package-manager: Path traversal (CVE-2026-18379). Brief link: https://feed.craftedsignal.io/briefs/2026-11-yggdrasil-path-traversal-cve-2026-18379/
Triage facts
Revision 1- Applicability
- yggdrasil-worker-package-manager
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:48 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-18379 is a path traversal vulnerability identified in the yggdrasil-worker-package-manager. An authenticated attacker can exploit this flaw by providing crafted repository names containing directory traversal sequences, such as '../'. This input is not properly sanitized, allowing the worker process to manipulate files outside of the intended directory context.
Impact
Exploitation of this vulnerability allows an attacker to modify or delete arbitrary files on the host system, potentially leading to unauthorized privilege escalation. The vulnerability is rated with a CVSS v3.1 base score of 8.8.
Recommendation
- Monitor repository management operations for inputs containing directory traversal characters such as '../'.