Debian:Debusine is an integrated build and distribution system for Debian-based projects. Its parser for the Debian source package manifest files, .dsc and .changes, accepts fully user‑controlled paths, a flaw classified as CWE‑59. An attacker can craft a malicious package manifest that contains arbitrary pathnames. When the mergeuploads task processes such a file, it will create symbolic links on the worker node, overwriting any file that the worker process can access. This effectively allows a local uploader to overwrite critical files and potentially achieve local privilege escalation or the injection of malicious binaries into the resulting package.

The vulnerability affects all current releases of Debian:Debusine that use the described parser, as the issue originates from unconstrained handling of .dsc and .changes file paths. No specific version range is listed, so any instance of Debian:Debusine that accepts and processes these manifest files without additional sanitization is affected.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation in the wild. The flaw is not listed in CISA KEV, and no public exploit is available. Attackers must be able to upload a crafted package file, so the attack vector is local to the build environment—this inference is based on the requirement for local upload access. The risk is that a malicious package uploader could overwrite files owned by the worker, potentially enabling privilege escalation or code execution. Organizations that rely on Debian:Debusine for their distribution pipeline should evaluate the risk and deploy a patch or mitigations promptly.