CVE-2026-18806 PUBLISHED

Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer

Assigner: TR-CERT
Reserved: 04.08.2026 Published: 04.08.2026 Updated: 04.08.2026

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.

This issue affects pardus-image-writer: before 1.0.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 7.1

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	TÜBİTAK BİLGEM Software Technologies Research Institute
Product	pardus-image-writer
Versions	Default: unaffected affected from 0 to 1.0.4 (excl.)

Credits

Emirhan YÜCEL finder

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0740

Problem Types

CWE-73 External control of file name or path CWE

Impacts

CAPEC-207 Removing Important Client Functionality