This vulnerability (CVE-2026-77113) involves a relative path traversal issue in the apport-unpack utility of Canonical Apport on Linux systems. Specifically, before versions 2.36.0, 2.34.2, and 2.28.4, apport-unpack improperly handles attacker-controlled key names in crash report files, enabling an attacker to write or overwrite arbitrary files with the permissions of the user running the process. This can lead to unauthorized file modification or creation, potentially impacting system integrity depending on the privileges of the executing user. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on integrity.

Successful exploitation allows an attacker to create or overwrite arbitrary files on the affected system with the privileges of the user executing apport-unpack. This could lead to unauthorized modification of files, potentially enabling further attacks or system compromise depending on the user's privileges. The vulnerability does not require privileges or authentication but does require user interaction and local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted crash report files with apport-unpack or run the utility with minimal privileges to reduce risk.