eopkg, the Solus package manager written in Python, contains a directory traversal flaw that allows a malicious package to bypass the --destdir option and place files at arbitrary paths on the host filesystem. The vulnerability manifests when installing a package from a source that is not properly verified, enabling the package maintainer to embed file paths that escape the targeted installation directory. This can compromise confidentiality and integrity by writing or overwriting critical files; while it does not directly provide remote code execution, it could be leveraged in conjunction with other vulnerabilities or as part of a larger attack chain.

GetSolus eopkg versions earlier than 4.4.0 are affected. Only installations of packages that come from untrusted or compromised sources are vulnerable; packages installed from the official Solus repositories are not impacted. The flaw applies to all platforms where eopkg is used, as the hit is on the package installation process itself.

The CVSS v3 score is 5.8, indicating a medium severity bug. The EPSS score is below 1%, implying a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to supply a malicious package and trigger eopkg to install it, so the attack vector is local or requires trust in the package source. Because of the low exploitation probability, immediate patching is still recommended but urgent response may not be critical for all users.