{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/filesystem-manipulation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tubitak:pardus-boot-repair:1.0.8:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.3,"id":"CVE-2026-92080"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pardus-boot-repair (1.0.8 through \u003c 1.1.0)"],"_cs_severities":["low"],"_cs_tags":["path-traversal","linux","filesystem-manipulation"],"_cs_type":"advisory","_cs_vendors":["TÜBİTAK BİLGEM Software Technologies Research Institute"],"content_html":"\u003cp\u003eCVE-2026-92080 is a path traversal vulnerability in the \u003ccode\u003epardus-mount-rootfs\u003c/code\u003e utility, a component of \u003ccode\u003epardus-boot-repair\u003c/code\u003e. The vulnerability arises because the utility reads mountpoint paths directly from a target filesystem's \u003ccode\u003e/etc/fstab\u003c/code\u003e and concatenates them without adequate validation. An attacker who can control the \u003ccode\u003efstab\u003c/code\u003e content of a filesystem processed by this tool can cause the application to perform a mount operation outside of its intended \u003ccode\u003eDESTDIR\u003c/code\u003e, potentially leading to unauthorized filesystem access with elevated privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a privileged mount escape, allowing the mounting of filesystems at arbitrary paths on the host. This impacts system integrity by providing an attacker with a mechanism to manipulate or expose file paths on the host system. The specific consequences of such an escape depend on the host environment and the filesystem contents chosen by the attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003epardus-boot-repair\u003c/code\u003e to version 1.1.0 or later as advised by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for the usage of the \u003ccode\u003e/usr/bin/pardus-mount-rootfs\u003c/code\u003e utility, particularly when invoked with untrusted or externally sourced filesystem images.\u003c/li\u003e\n\u003cli\u003eAudit logs for instances where mount operations result in paths outside of expected repair directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T10:25:22Z","date_published":"2026-11-09T10:25:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pardus-boot-repair-traversal/","summary":"A path traversal vulnerability in the pardus-mount-rootfs helper of pardus-boot-repair allows a malicious /etc/fstab to execute a privileged mount outside of the intended repair root directory.","title":"Pardus Boot Repair: Path traversal in pardus-mount-rootfs (CVE-2026-92080)","url":"https://feed.craftedsignal.io/briefs/2026-11-pardus-boot-repair-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Filesystem-Manipulation","version":"https://jsonfeed.org/version/1.1"}