The vulnerability is a path traversal flaw in apport-unpack that lets an attacker supply attacker‑controlled key names in crash report files. This flaw allows the creation or overwrite of arbitrary files with the privileges of the executing user. The weakness is a classic directory traversal condition (CWE‑23) which can compromise confidentiality and integrity on the affected system.

Affected systems are Canonical Apport installations running versions older than 2.36.0, 2.34.2, or 2.28.4 on Linux. The vulnerability exists in the apport-unpack component provided by Canonical, which is used in many Ubuntu and Debian derivative releases.

The CVSS score of 6.7 indicates medium severity, and there is no EPSS score available. The vulnerability is not listed in the CISA KEV catalog. The attack is likely possible from the local environment where a user can write crash report files, implying that local privilege escalation or untrusted process compromises could be used. Because the flaw writes files with the current user’s permissions, near‑inevitable damage can occur if an attacker gains write access to the crash‑report path.