CVE-2026-77113: Canonical Apport

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

Affected products

• Canonical Apport: before 2.36.0 (fixed in 2.36.0); before 2.34.2 (fixed in 2.34.2); before 2.28.4 (fixed in 2.28.4)

Published 2026-08-20. Last modified 2026-08-28.