Description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection.

This issue affects Pardus Software: before 1.0.5.
Published: 2026-09-11
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command injection flaw (CWE‑78) in TUBITAK BILGEM Software Technologies Research Institute’s Pardus Software that results from improper neutralization of special elements used in an OS command execute arbitrary operating‑system commands. Based on the description, it is inferred that such arbitrary command execution can compromise the confidentiality, integrity, and availability of the affected system.

Affected Systems

TUBITAK BILGEM Software Technologies Research Institute’s Pardus Software versions prior to 1.0.5.

Risk and Exploitability

The CVSS score of 8.4 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector would involve an attacker providing crafted input that reaches the vulnerable component, which could be possible remotely or locally by an unprivileged user; the exact prerequisites are not explicitly stated in the description.

Generated by OpenCVE AI on September 11, 2026 at 18:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pardus Software to version 1.0.5 or newer to apply the vendor patch that eliminates the command injection flaw.
  • If an upgrade is not immediately feasible, limit the privileges of the component that constructs the OS command, ensuring it runs with the least privilege required.
  • Sanitize or validate all external input before it is used to build or execute shell commands, escaping shell metacharacters to prevent injection.
  • Audit the system for signs of unauthorized command execution and monitor logs for anomalous activity that could indicate exploitation.

Generated by OpenCVE AI on September 11, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus-software
Vendors & Products Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus-software
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5.
Title OS Command Injection in TUBITAK BILGEM's Pardus Software
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Tubitak Bilgem Software Technologies Research Institute Pardus-software
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-11T16:26:00.605Z

Reserved: 2026-05-05T12:18:08.349Z

Link: CVE-2026-7863

cve-icon Vulnrichment

Updated: 2026-09-11T16:25:48.651Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T16:17:47.490

Modified: 2026-09-11T17:35:21.440

Link: CVE-2026-7863

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T20:45:02Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')