Executive brief
Pardus Boot Repair is a system utility for repairing boot issues on Linux systems. An OS command injection flaw allows attackers to execute arbitrary system commands with the privileges of the user running the application, potentially leading to full system compromise, data exfiltration, or malicious code installation.
Technical details
The vulnerability is an OS command injection (CWE-78) in Pardus Boot Repair prior to version 1.0.8, where special shell metacharacters in user input are not properly neutralized before being passed to OS command execution functions. The attack vector is network or local depending on how the application is invoked; if network-accessible, an unauthenticated attacker can craft malicious input to break out of the intended command context and execute arbitrary commands. Successful exploitation grants the attacker the execution privileges of the Boot Repair process, which may run with elevated permissions. Patches are available in version 1.0.8 and later.
Affected products
- TUBITAK BILGEM Pardus Boot Repair before 1.0.8
Timeline
- 2026-09-11: disclosed