CVE-2026-21437: eopkg Information Disclosure Flaw

CVE-2026-21437 Overview

CVE-2026-21437 is a file tracking bypass vulnerability in eopkg, the Solus Linux package manager implemented in Python 3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by eopkg. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by lseopkg and related tools, potentially allowing hidden persistence mechanisms or unauthorized modifications to go undetected.

Critical Impact

A malicious package installed from an untrusted source could deposit untracked files on the system, evading detection by standard package management tools and potentially enabling persistent unauthorized access.

Affected Products

• eopkg versions prior to 4.4.0
• Solus Linux systems using affected eopkg versions
• Systems installing packages from non-official Solus repositories

Discovery Timeline

• 2026-01-01 - CVE CVE-2026-21437 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2026-21437

Vulnerability Analysis

This vulnerability relates to CWE-353 (Missing Support for Integrity Check), where the package manager fails to properly track all files installed by a package. When a malicious package is installed, it can include files that bypass the standard file tracking mechanism. These untracked files persist on the system but remain invisible to package management queries like lseopkg, creating a blind spot in system integrity monitoring.

The attack requires local access and user interaction, as the victim must install a package from a malicious or compromised repository. Users who only install packages from official Solus repositories are not affected by this vulnerability.

Root Cause

The root cause lies in insufficient path normalization and file tracking within the eopkg archive handling code. The vulnerability allowed certain file paths within packages to evade the tracking system, meaning files could be extracted and placed on the system without being registered in the package database. This gap between what's installed and what's tracked creates an opportunity for hiding malicious files.

Attack Vector

The attack vector requires local access with high privileges and active user participation. An attacker would need to:

1. Create a malicious package containing untracked files
2. Distribute the package through a compromised or malicious repository
3. Convince the user to install the package from that non-official source

Once installed, the hidden files could serve various malicious purposes while remaining invisible to standard package queries.

# Security patch showing the fix in pisi/archive.py
# Source: https://github.com/getsolus/eopkg/commit/e7694323ed64e08b5b4b108fff273c64125cd39d

 import lzma
 
 from pisi import translate as _
-from pisi.usr_merge import is_usr_merged_duplicate
+from pisi.path import is_usr_merged_duplicate, normpath
 
 # eopkg modules
 import pisi

Source: GitHub Commit Update

The fix introduces proper path normalization (normpath) to ensure consistent file tracking regardless of how paths are specified within packages.

Detection Methods for CVE-2026-21437

Indicators of Compromise

• Presence of files on the system that are not tracked by any installed package
• Discrepancies between file system contents and package database records
• Unexpected files in system directories not reported by lseopkg
• Evidence of package installations from non-official repositories in system logs

Detection Strategies

• Compare file system contents against eopkg package database using integrity verification tools
• Audit package installation history for installations from non-official sources
• Implement file integrity monitoring (FIM) independent of the package manager
• Review system logs for package installations from unknown or suspicious repositories

Monitoring Recommendations

• Deploy host-based intrusion detection systems (HIDS) with file integrity monitoring
• Monitor /var/log/ for package installation activities from untrusted sources
• Establish baseline file system inventories and alert on untracked additions
• Use SentinelOne endpoint protection to detect suspicious file creation activities independent of package management

How to Mitigate CVE-2026-21437

Immediate Actions Required

• Upgrade eopkg to version 4.4.0 or later immediately
• Audit systems for packages installed from non-official repositories
• Perform file system integrity checks to identify any untracked files
• Remove any packages installed from untrusted or compromised sources

Patch Information

The vulnerability has been fixed in eopkg version 4.4.0. The fix is available in the GitHub Release v4.4.0. Technical details of the patch can be found in GitHub Pull Request #201 and the associated security advisory GHSA-hjp7-qwrj-6cc6.

Workarounds

• Only install packages from the official Solus repositories until patched
• Implement strict repository trust policies blocking third-party package sources
• Deploy additional file integrity monitoring tools independent of eopkg
• Review and audit any previously installed third-party packages

# Upgrade eopkg to the patched version
sudo eopkg upgrade eopkg

# Verify eopkg version
eopkg --version

# Check for packages from non-official sources
eopkg list-installed | grep -v "solus"