Path Traversal Vulnerability in Apport by Canonical

CVE-2026-86692

What is CVE-2026-86692?

A path traversal vulnerability in Apport allows attackers to exploit specially crafted crash reports to create or overwrite arbitrary files beyond the intended extraction directory. This vulnerability exploits a lack of validation in handling base64-encoded keys during the report processing, particularly in ProblemReport.load and ProblemReport.extract_keys functions. As a result, attackers can compromise writable files, like .bashrc or .profile, leading to potential persistence or execution of arbitrary code under the user's rights.

References