An improper limitation of a pathname to a restricted directory in TUBITAK BILGEM’s Pardus Software Center allows an attacker to specify an arbitrary file path, causing the application to access files outside its intended directory. This could expose sensitive configuration, credential data, or other confidential files, and may enable further integrity violations if the application can write to these paths. The flaw is a classic location-based input validation failure, classified as CWE‑22, and is rated highly severe.

The issue affects all installations of the Pardus Software Center distributed by TUBITAK BILGEM Software Technologies Research Institute that are at versions before 1.0.3.

The CVSS score of 9.6 marks this flaw as critical, and the EPSS score is not available while it is not listed in the CISA KEV catalog, indicating no known public exploitation yet. Based on the description, it is inferred that the vulnerability could be leveraged remotely if the Software Center is exposed over a network, or locally if an attacker has the ability to interact with the application from within the system. The lack of mitigation guidance in the advisory underscores the need for immediate action to prevent potential data breaches or further compromise.