CVE-2026-77113

Apport's path traversal (CVE-2026-77113) is a textbook case of infrastructure code whose threat model failed to track its deployment context. The crash reporter processes genuinely untrusted input—crash dumps from failed applications—but was developed under the implicit assumption that its inputs are 'just crash data' rather than attacker vectors. The vulnerability: key names from crash reports flow into filesystem operations without path normalization, allowing traversal and file overwrite as the executing user. The修复的性质决定了长期风险。If the patch added path normalization at the extraction point (jailing the unpack operation to a safe directory), that's deployment hardening—it stops this instantiation but leaves the underlying assumption intact. If the patch implemented strict schema validation on key names before they're used anywhere, that's code correctness—it addresses the class of bug. You need to examine the commit to know which approach was taken, because that determines your residual risk. Audit the codebase for other consumers of parsed crash report fields—where else do key values flow into filesystem operations? Also check legacy extraction paths for older report formats, which often retain unsanitized behavior when main parsing logic is hardened. The CVSS 6.7 rating obscures a real exploitability spectrum: against users with custom dotfiles, SSH keys, or automated cron/systemd jobs, this is a reliable local privilege escalation. The attack is simple—overwrite ~/.ssh/authorized_keys or a cron script—but the post-exploitation cascade depends on what privileged operations the executing user automates.

Reviewed through automated stages and approved by a human before publication.