Executive brief
Apport is a system tool used by Linux distributions to collect and process diagnostic crash reports. A path traversal vulnerability in apport-unpack allows an attacker to create or overwrite arbitrary files outside the intended extraction directory when processing a malicious crash report file. An attacker could modify configuration files like .bashrc or .profile to execute arbitrary code when the affected user logs in.
Technical details
The vulnerability is a path traversal flaw in the apport-unpack utility and ProblemReport.load() function. The root cause is that crash report files are parsed to extract key/value pairs, and keys (which should be restricted to alphanumeric characters, dots, underscores, and hyphens) are not validated when loading reports from disk—only when programmatically assigned via __setitem__(). As a result, malicious keys containing path separators (e.g., "../escaped" or absolute paths) are written directly to disk using os.path.join(target_directory, key) without constraints, allowing traversal outside the destination directory. The vulnerability can be exploited by supplying a crafted apport report file with traversal sequences in key names; no authentication is required. An attacker can create or overwrite arbitrary files with the privileges of the user running apport-unpack, potentially leading to code execution through modification of startup scripts or configuration files. Patches are available in Apport 2.36.0, 2.34.2, and 2.28.4.
Affected products
- Canonical Apport before 2.36.0, 2.34.2, and 2.28.4
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Patch merged in GitHub PR #646