CVE-2026-18379
Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo
- High 8.8
Description
A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.808% likely to be exploited in the next 30 days, higher than 57.414% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 8.8CVSS 3.1, Highfrom the CNA (redhat)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What to do
- --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to sanitize repository names and enforce directory boundary validation to prevent traversal sequences from escaping /etc/yum.repos.d/ during file creation and deletion: upgrade to the fixed Yggdrasil Worker Package Manager builds, which apply the documented input check, closing crafted repository names containing directory traversal sequences. Until patched, this is a concern on Linux hosts running yggdrasil-worker-package-manager as root, so Restrict and audit authenticated access to dispatch directives through the management message broker to prevent malformed repository names from reaching the root worker. As a compensating measure, Configure auditd to log file creation, modification, and deletion syscalls initiated by the root worker across monitored system paths, Run SELinux in enforcing mode to confine the worker daemon and prevent writing or deleting files outside repository configuration file types, Deploy an EDR agent to monitor endpoint behavior and detect unauthorized file drops or suspicious cron and system modifications, Use Falco or eBPF runtime security tCNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
CNA context is abbreviated; consult the original record for the complete statements.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
|
Timeline
- 6 Oct 2026 Reported to Red Hat.
- 6 Nov 2026 Made public.
- 12 Nov 2026 Published
Weakness
Practice this bug class
HackZoneLabs has a hands-on lab on Path traversal (CWE-22).