CVE-2026-21436: eopkg Path Traversal Vulnerability

CVE-2026-21436 Overview

CVE-2026-21436 is a Path Traversal vulnerability affecting eopkg, the Solus package manager implemented in Python 3. In versions prior to 4.4.0, a malicious package could escape the directory set by the --destdir flag, allowing files to be written to arbitrary locations on the host system instead of the intended destination directory. This vulnerability requires the installation of a package from a malicious or compromised source.

Critical Impact

Attackers who can convince users to install malicious packages can write arbitrary files outside the intended installation directory, potentially leading to system compromise through file overwrites or placement of malicious executables.

Affected Products

• eopkg versions prior to 4.4.0
• Solus Linux distributions using vulnerable eopkg versions
• Users installing packages from untrusted or third-party repositories

Discovery Timeline

• 2026-01-01 - CVE CVE-2026-21436 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2026-21436

Vulnerability Analysis

This vulnerability is classified as CWE-24 (Path Traversal: '../filedir'), which occurs when the application fails to properly neutralize path traversal sequences in file operations. The eopkg package manager did not adequately validate file paths extracted from package archives when the --destdir option was specified. This allowed malicious packages to include specially crafted file paths containing directory traversal sequences that would escape the designated destination directory.

The attack requires local access and user interaction, as the victim must explicitly install a malicious package. While this limits the attack surface, successful exploitation could lead to significant integrity impacts on both the local system and potentially connected systems if critical files are overwritten.

Root Cause

The root cause lies in insufficient path normalization when extracting files from package archives. The original implementation did not properly sanitize or validate file paths before combining them with the --destdir prefix. A malicious package could contain files with paths like ../../etc/cron.d/malicious which, when extracted, would escape the intended destination directory and write to arbitrary locations on the filesystem.

The fix involved importing and utilizing a proper normpath function from a dedicated path handling module (pisi.path) to ensure all paths are properly normalized before file operations occur.

Attack Vector

The attack requires a local vector where an attacker must first create a malicious eopkg package containing files with path traversal sequences. The attacker then needs to distribute this package through a compromised repository or convince a user to install it directly. When the user installs the package using the --destdir option, the malicious files escape the designated directory and are written to attacker-controlled locations on the host system.

# Security patch in pisi/archive.py - Path normalization fix
 import lzma
 
 from pisi import translate as _
-from pisi.usr_merge import is_usr_merged_duplicate
+from pisi.path import is_usr_merged_duplicate, normpath
 
 # eopkg modules
 import pisi

Source: GitHub Commit Reference

# Security patch in pisi/atomicoperations.py - Updated import
 """Atomic package operations such as install/remove/upgrade"""
 
 from pisi import translate as _
-from pisi.usr_merge import is_usr_merged_duplicate
+from pisi.path import is_usr_merged_duplicate
 
 import os
 import shutil

Source: GitHub Commit Reference

Detection Methods for CVE-2026-21436

Indicators of Compromise

• Unexpected files appearing outside of normal package installation directories
• Suspicious package installations from non-official Solus repositories
• Files in system directories with modification timestamps matching recent package installations
• Presence of packages with unusual file path structures in installation logs

Detection Strategies

• Monitor eopkg installation logs for packages originating from untrusted sources
• Implement file integrity monitoring on critical system directories
• Audit installed packages and verify their origin against official Solus repository signatures
• Review package contents before installation when sourcing from third-party repositories

Monitoring Recommendations

• Enable verbose logging for eopkg package installations
• Monitor system directories for unexpected file creations during package operations
• Set up alerts for eopkg installations using the --destdir flag from non-standard sources
• Implement endpoint detection for file writes to sensitive system locations during package manager operations

How to Mitigate CVE-2026-21436

Immediate Actions Required

• Upgrade eopkg to version 4.4.0 or later immediately
• Only install packages from the official Solus repositories
• Audit recently installed packages from any third-party sources
• Review system for any unexpected files that may have been written outside intended directories

Patch Information

The vulnerability has been fixed in eopkg version 4.4.0. The fix introduces proper path normalization through a dedicated pisi.path module that sanitizes file paths before extraction. Users should update to the latest version by following the standard Solus package update process.

For detailed information about the fix, see the GitHub Security Advisory GHSA-786v-47cq-qm6m and the GitHub Release v4.4.0.

Workarounds

• Avoid using the --destdir flag with packages from untrusted sources until patched
• Only install packages from official Solus repositories which are not affected
• Manually inspect package contents before installation when third-party packages are required
• Run package installations in a sandboxed environment when dealing with untrusted packages

# Update eopkg to the patched version
sudo eopkg upgrade eopkg

# Verify eopkg version is 4.4.0 or later
eopkg --version

# Check package source before installation
eopkg info <package-name>