This vulnerability is a classic Path Traversal flaw (CWE-22) that enables an attacker to resolve pathnames outside an approved directory boundary in the pardus-boot-repair utility. The flaw permits reading arbitrary files on the underlying file system, potentially exposing sensitive data such as configuration files, credentials, or user data. The impact includes confidentiality compromise and, if the exploited files contain executable or key material, potential escalation to more serious compromise.

The flaw affects pardus-boot-repair versions prior to 1.1.0, specifically 1.0.9 and earlier releases. The product is distributed by the TÜBİTAK BİLGEM Software Technologies Research Institute. No later versions are mentioned as vulnerable.

The CVSS score of 6.6 indicates moderate severity, and the absence of an EPSS value means current exploit likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Probability of exploitation is presumably low to moderate without an identifiable public exploit. The attack vector is inferred as remote via any input mechanism the utility exposes, such as network, file, or user-supplied arguments.