Threats tagged 'ghsa-73xf-6738-4xhx'

CVE-2026-18379 is a path traversal vulnerability in yggdrasil-worker-package-manager that allows an authenticated attacker to perform arbitrary file modifications or potential privilege escalation. The flaw arises because repository management operations do not sanitize directory traversal sequences in repository names, enabling manipulation of files outside the intended directory. Exploitation requires authenticated access to the management control plane and the ability to dispatch malformed directives through the message broker. The package manager worker runs with root privileges, increasing the risk of system compromise. Red Hat rates the impact as moderate due to the prerequisite access and constrained risk in standard deployments. Mitigations include restricting authenticated access, auditing file operations, enforcing SELinux policies, and applying an official patch once available.