CVE-2026-21437: eopkg Information Disclosure Flaw

CVE-2026-21437 Overview

CVE-2026-21437 is a file tracking bypass vulnerability in eopkg, the Solus Linux package manager implemented in Python 3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by eopkg. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by lseopkg and related tools, potentially allowing hidden persistence mechanisms or unauthorized modifications to go undetected.

Critical Impact
A malicious package installed from an untrusted source could deposit untracked files on the system, evading detection by standard package management tools and potentially enabling persistent unauthorized access.

Affected Products

eopkg versions prior to 4.4.0
Solus Linux systems using affected eopkg versions
Systems installing packages from non-official Solus repositories

Discovery Timeline

2026-01-01 - CVE CVE-2026-21437 published to NVD
2026-01-02 - Last updated in NVD database

Technical Details for CVE-2026-21437

Vulnerability Analysis

This vulnerability relates to CWE-353 (Missing Support for Integrity Check), where the package manager fails to properly track all files installed by a package. When a malicious package is installed, it can include files that bypass the standard file tracking mechanism. These untracked files persist on the system but remain invisible to package management queries like lseopkg, creating a blind spot in system integrity monitoring.

The attack requires local access and user interaction, as the victim must install a package from a malicious or compromised repository. Users who only install packages from official Solus repositories are not affected by this vulnerability.

Root Cause

The root cause lies in insufficient path normalization and file tracking within the eopkg archive handling code. The vulnerability allowed certain file paths within packages to evade the tracking system, meaning files could be extracted and placed on the system without being registered in the package database. This gap between what's installed and what's tracked creates an opportunity for hiding malicious files.

Attack Vector

The attack vector requires local access with high privileges and active user participation. An attacker would need to:

Create a malicious package containing untracked files
Distribute the package through a compromised or malicious repository
Convince the user to install the package from that non-official source

Once installed, the hidden files could serve various malicious purposes while remaining invisible to standard package queries.

python

# Security patch showing the fix in pisi/archive.py
# Source: https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39d

 import lzma
 
 from pisi import translate as _
-from pisi.usr_merge import is_usr_merged_duplicate
+from pisi.path import is_usr_merged_duplicate, normpath
 
 # eopkg modules
 import pisi

Source: GitHub Commit Update

The fix introduces proper path normalization (normpath) to ensure consistent file tracking regardless of how paths are specified within packages.

Detection Methods for CVE-2026-21437

Indicators of Compromise

Presence of files on the system that are not tracked by any installed package
Discrepancies between file system contents and package database records
Unexpected files in system directories not reported by lseopkg
Evidence of package installations from non-official repositories in system logs

Detection Strategies

Compare file system contents against eopkg package database using integrity verification tools
Audit package installation history for installations from non-official sources
Implement file integrity monitoring (FIM) independent of the package manager
Review system logs for package installations from unknown or suspicious repositories

Monitoring Recommendations

Deploy host-based intrusion detection systems (HIDS) with file integrity monitoring
Monitor /var/log/ for package installation activities from untrusted sources
Establish baseline file system inventories and alert on untracked additions
Use SentinelOne endpoint protection to detect suspicious file creation activities independent of package management

How to Mitigate CVE-2026-21437

Immediate Actions Required

Upgrade eopkg to version 4.4.0 or later immediately
Audit systems for packages installed from non-official repositories
Perform file system integrity checks to identify any untracked files
Remove any packages installed from untrusted or compromised sources

Patch Information

The vulnerability has been fixed in eopkg version 4.4.0. The fix is available in the GitHub Release v4.4.0. Technical details of the patch can be found in GitHub Pull Request #201 and the associated security advisory GHSA-hjp7-qwrj-6cc6.

Workarounds

Only install packages from the official Solus repositories until patched
Implement strict repository trust policies blocking third-party package sources
Deploy additional file integrity monitoring tools independent of eopkg
Review and audit any previously installed third-party packages

bash

# Upgrade eopkg to the patched version
sudo eopkg upgrade eopkg

# Verify eopkg version
eopkg --version

# Check for packages from non-official sources
eopkg list-installed | grep -v "solus"