The vulnerability CVE-2026-18806 in pardus-image-writer allows external control over file names or paths, potentially enabling attackers with limited privileges to remove critical client functionality. It affects versions prior to 1.0.4. The CVSS 3.1 score is 7.1, indicating high severity with local attack vector, low complexity, requiring low privileges and no user interaction, impacting integrity and availability but not confidentiality. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with local access and low privileges can exploit this vulnerability to manipulate file paths or names, resulting in the removal of important client functionality. This impacts the integrity and availability of the affected system but does not affect confidentiality. The vulnerability could disrupt normal operations of pardus-image-writer.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity related to file operations within pardus-image-writer.