Directory Traversal Vulnerability in Yggdrasil Worker Package Manager by Red Hat

CVE-2026-18379

What is CVE-2026-18379?

A security flaw identified in the Yggdrasil Worker Package Manager allows authenticated attackers to exploit directory traversal sequences, leading to arbitrary file modification or privilege escalation. This vulnerability arises from the failure to properly sanitize input when performing repository management operations, particularly in handling directory traversal patterns like '../'. An attacker can craft a malicious repository name to manipulate processes, potentially creating or deleting files outside designated directories, thereby jeopardizing the integrity of the host system.

References