Isar, an automated root filesystem generator, creates the directory /etc/apt/trusted.gpg.d during bootstrap so local GPG keys can be deployed. In all versions 0.11 and newer the directory is owned by the user who runs Isar rather than by root. If that user’s UID matches an unprivileged user inside the resulting image, the user can modify or add keys to the trusted list. Changing these keys silently breaks the apt repository’s integrity protection, enabling a later attacker to deliver malicious packages or manipulate package delivery. The vulnerability itself does not provide a direct exploitation path; it is a prerequisite for further attacks that require either a malicious remote repository or interception of non‑secure communications.

The affected product is Isar from ilbers, version 0.11 and beyond. The vulnerability exists in configurations where Isar is executed with a user whose UID is reused by an unprivileged image user, and where apt is active in the image.

The CVSS score of 5.1 indicates a moderate severity. An EPSS value is unavailable, and the issue is not listed in CISA’s KEV catalog. The likely exploitation path requires local execution of Isar by the attacker or ensuring the attacker’s UID matches a non‑privileged image user, followed by manipulation of a remote repository or insecure transport to deliver compromised packages. The attack vector is thus local with a chain of subsequent steps that are not guaranteed to succeed without additional conditions.