CVE-2026-5166 is a CWE-22 path traversal vulnerability in the Pardus Software Center before version 1.0.3. It allows an attacker to improperly limit pathname access, enabling traversal outside restricted directories. The vulnerability has a critical CVSS score of 9.6, indicating it can be exploited remotely without privileges but requires user interaction, and it affects confidentiality, integrity, and availability with scope change. The vendor has not yet provided an official fix or remediation level. The product is not a cloud service, so remediation depends on patching the software locally. No known exploits are reported.

Successful exploitation of this vulnerability can lead to an attacker accessing or modifying files outside the intended directory restrictions, potentially resulting in full system compromise. The CVSS score of 9.6 indicates critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor for updates from TUBITAK BILGEM Software Technologies Research Institute and plan to upgrade to version 1.0.3 or later once released. Until then, limit exposure by restricting access to the Pardus Software Center and exercising caution with user interactions that could trigger the vulnerability.