CVE-2026-8301

OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair

View on CVE.org
Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.

This issue affects Pardus Boot Repair: before 1.0.8.

Analysis

AI-generated

Technical impact

The vulnerability is an OS command injection in Pardus Boot Repair. The application fails to neutralize special elements used in an OS command, allowing an attacker to inject arbitrary shell commands. If an attacker can trigger the affected functionality, they could execute commands with the privileges of the process, potentially gaining full system control. The weakness is classified as CWE-78.

Affected Systems

TUBITAK BILGEM Software Technologies Research Institute offers Pardus Boot Repair. Versions prior to 1.0.8 are affected. Upgrading to version 1.0.8 or later removes the vulnerability.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, and the EPSS score is unavailable. The vulnerability is not currently listed in the CISA KEV catalog. Because the tool operates with elevated privileges to modify boot configuration, the likely attack vector is a local user or an attacker with access to the repair utility. An exploit could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Pardus Boot Repair to version 1.0.8 or later.
  • If an update is not immediately possible, restrict the executable’s permissions so only authorized users can run it, or disable the command execution features it uses.
  • Monitor system logs for attempts to invoke the tool with suspicious parameters and audit any anomalous activity.

Generated by OpenCVE AI on September 11, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus Boot Repair
Vendors & Products Tubitak Bilgem Software Technologies Research Institute
Tubitak Bilgem Software Technologies Research Institute pardus Boot Repair
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: before 1.0.8.
Title OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
TR-CERT
Published
Updated
Sep 11, 2026, 3:01 PM
Reserved
May 11, 2026, 10:42 AM

View source JSON

Updated
Sep 11, 2026, 3:01 PM

JSON

Status
Deferred
Published
Sep 11, 2026, 3:17 PM
Modified
Sep 11, 2026, 5:35 PM

View source JSON

No data.

Updated
Sep 11, 2026, 8:45 PM

JSON