Apport apport-unpack Path Traversal Leads to Arbitrary File Write and RCE

Vulnerability Overview Vulnerability Name: Path Traversal in apport-unpack Allows Arbitrary File Write Outside the Destination Directory Could Lead to RCE Vulnerability Description: accepts user-supplied report files, parses each report key, and writes each key/value pair to the requested output directory on disk. The expected trust model is that keys behave like simple field names; however, the parser accepts arbitrary ASCII keys from untrusted report content, and the unpacking logic uses these keys as path components without restricting them to the target directory. Root Cause Chain: 1. The list is used to store keys from report items. 2. decodes keys from attacker-controlled report content but does not reject path separators, traversal segments, or absolute paths. 3. A second reachable exists in binary/base64 entries. After the initial unpacking pass, calls , reusing the same unsafe path construction. Impact: Attackers can cause unexpected file creation or overwriting outside the expected extraction directory by providing malicious diagnostic/problem reports. Exploitation occurs in the context of privilege escalation, potentially affecting developers, support personnel, analysts, or debugging workflows. In some cases, if user-writable startup or configuration files are accessible, it may lead to configuration modification, workflow disruption, or persistence opportunities. Scope Affected Component: Impact Level: High Fix Status: Fix Released Milestone: Apport 2.36.0 Remediation Fix Commit: https://github.com/canonical/apport/pull/646 Fix Content: Fixed the path traversal issue, ensuring keys behave like simple field names and do not treat arbitrary ASCII keys as path components. Verification: The fix is included in Apport 2.36.0, and verification confirms that malicious report files cannot write files outside the intended directory. POC Code CVE Reference CVE-2026-77113: Assigned to this vulnerability. Comments and Discussion Sakib Sarkar (bxoii): Reported the vulnerability and provided detailed POC and explanation. Federico Quattrin (federicoquattrin): Confirmed the vulnerability and discussed the fix. Benjamin Drung (bdrung): Proposed the fix and verified its effectiveness. Conclusion This vulnerability allows attackers to cause unexpected file creation or overwriting outside the intended extraction directory by supplying malicious report files. The fix has been submitted and verified, ensuring that keys behave like simple field names and do not treat arbitrary ASCII keys as path components.

Goal Reached Thanks to every supporter — we hit 100%!

Apport apport-unpack Path Traversal Leads to Arbitrary File Write and RCE