debos mergeuploads Path Traversal Leading to Container Breakout (CVE-2026-11853)

Vulnerability Overview Vulnerability ID: CVE-2026-11853 Vulnerability Name: Improper path sanitization in mergeuploads task Description: In the task, the parser accepts slashes containing absolute paths (such as in the and sections). When is called, is calculated as , where the latter is not validated. Consequently, is entirely user-controlled, achieved by pre-creating sufficient sequences or using absolute paths. This location is then created as a symbolic link, unless it already exists. Therefore, a malicious user can create arbitrary symbolic links with the permissions of , without needing to independently control the symbolic link target. This constitutes a minor container breakout. Scope of Impact Affected Component: task Potential Risk: Malicious users can create arbitrary symbolic links, potentially leading to container breakout. Remediation Status: Fixed Fix Commits: - Commit ID: - Commit Message: Reject checksum filenames with multiple path components - Merge Request: - Merge Time: 1 week ago POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Additional Information Reporter: Helmut Grohne Fixer: Colin Watson Labels: , , Milestone: 2026-Q2 Maintenance Dates: - Start Date: None - End Date: None Time Tracking: No estimated or spent time Participants: 3 people Activity Log Helmut Grohne: Added labels , , (1 week ago) Colin Watson: - Changed milestone to 2026-Q2 Maintenance (1 week ago) - Assigned to @cjwatson (1 week ago) - Mentioned in merge request (1 week ago) - Mentioned in commit (1 week ago) - Closed merge request (1 week ago) - Closed commit (1 week ago) Summary This vulnerability involves a path sanitization issue in the task, which could lead to a container breakout. The fix has been implemented via merge request ; specific code is not provided.

Goal Reached Thanks to every supporter — we hit 100%!

debos mergeuploads Path Traversal Leading to Container Breakout (CVE-2026-11853)