CVE Intelligence
Analysis AI-assisted

CVE-2026-5166: Path Traversal in TUBITAK BILGEM Pardus Software Center

CVE-2026-5166 is a path traversal weakness (CWE-22) in the Pardus Software Center developed by TUBITAK BILGEM, affecting versions before 0.6.4. The CNA-provided CVSS 3.1 base score is 9.6 (critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A path traversal weakness (CWE-22) was reported in the Pardus Software Center developed by TUBITAK BILGEM. According to the record, versions before 0.6.4 are affected. The CVE was published on 2026-04-29 by the CNA TR-CERT.

Impact

The CVSS 3.1 base score supplied by the CNA is 9.6 (critical). The vector describes network access, low complexity, no required privileges, user interaction, a changed scope, and high impact on confidentiality, integrity and availability. Path traversal flaws generally allow access to files outside the intended directory, but the sources consulted do not describe the specific code path, so the real effect depends on how the component handles file paths.

Affected products and versions

  • TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center: versions before 0.6.4.
  • The record lists no fixed version. The affected range suggests 0.6.4 is the first version outside it, but this should be confirmed with the vendor or the official notices.

Exploitation status

This CVE is not listed in CISA KEV. The record's SSVC data shows exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory all installations of Pardus Software Center and record their versions.
  • Prioritize upgrading to 0.6.4 or later, and follow the guidance in the official notices.
  • Until the update is applied, restrict access to the software center to trusted users and networks, and limit the file permissions of the service account to the minimum required.

Detection guidance

  • Review application and system logs for file operations that reference paths outside the expected application directories.
  • Monitor the software center process for unusual file reads or writes.

Limitations of the available information

  • The record does not identify specific vulnerable components, endpoints or a fixed release.
  • The notice from USOM is marked as a broken link in the record. The Siber Güvenlik notice is also referenced.
  • The EPSS value is a modeled probability and percentile, not evidence of exploitation.

Frequently asked questions

What is CVE-2026-5166?

It is a path traversal vulnerability (CWE-22) in TUBITAK BILGEM's Pardus Software Center. The record says versions before 0.6.4 are affected.

How severe is it?

The CNA-supplied CVSS 3.1 base score is 9.6, rated critical. The record does not describe the exact technical path, so the real-world effect is not fully confirmed.

Is it being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Inventory installations, prioritize moving to version 0.6.4 or later per official guidance, and restrict access to the software center until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.