# CVE-2026-77113: Canonical Apport path traversal in apport-unpack

Source: https://junglewise.ai/threats/cve-2026-77113-canonical-apport-path-traversal-in-apport-unpack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77113 · Severity: info · CVSS 0 · Published 2026-08-20

Apport is a system tool used by Linux distributions to collect and process diagnostic crash reports. A path traversal vulnerability in apport-unpack allows an attacker to create or overwrite arbitrary files outside the intended extraction directory when processing a malicious crash report file. An attacker could modify configuration files like .bashrc or .profile to execute arbitrary code when the affected user logs in.

Technologies: [Canonical Apport](https://junglewise.ai/threats/technologies/apport). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-77113 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77113 being exploited in the wild.

**How severe is CVE-2026-77113?** Informational severity, with a CVSS score of 0, published 20 August 2026.

**Which products and versions are affected?** Canonical Apport before 2.36.0, 2.34.2, and 2.28.4.

**Is there a fix for CVE-2026-77113?** A patch was published on 2026-08-20: Patch merged in GitHub PR #646 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77113 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-77113?** Check whether you run Canonical Apport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the apport-unpack utility and ProblemReport.load() function. The root cause is that crash report files are parsed to extract key/value pairs, and keys (which should be restricted to alphanumeric characters, dots, underscores, and hyphens) are not validated when loading reports from disk—only when programmatically assigned via __setitem__(). As a result, malicious keys containing path separators (e.g., "../escaped" or absolute paths) are written directly to disk using os.path.join(target_directory, key) without constraints, allowing traversal outside the destination directory. The vulnerability can be exploited by supplying a crafted apport report file with traversal sequences in key names; no authentication is required. An attacker can create or overwrite arbitrary files with the privileges of the user running apport-unpack, potentially leading to code execution through modification of startup scripts or configuration files. Patches are available in Apport 2.36.0, 2.34.2, and 2.28.4.

## Affected products

- Canonical Apport before 2.36.0, 2.34.2, and 2.28.4

## Timeline

- 2026-08-20: disclosed
- 2026-08-20: patched: Patch merged in GitHub PR #646

## References

- [https://github.com/canonical/apport/pull/646](https://github.com/canonical/apport/pull/646)
- [https://launchpad.net/bugs/2161697](https://launchpad.net/bugs/2161697)

## Related threats

- [apport path traversal in extract_keys via base64-encoded keys](https://junglewise.ai/threats/cve-2026-86692-in-apport-before-2-37-0-a-path-traversal-vulnerability-allows-an)
- [apport improper privilege management via ldd DT_AUDIT code execution](https://junglewise.ai/threats/cve-2026-84410-in-apport-before-2-37-0-an-improper-privilege-management)
- [It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash…](https://junglewise.ai/threats/cve-2025-5467-it-was-discovered-that-process-crash-in-data-apport-in-canonical-s)