In apport versions before 2.37.0 a path traversal flaw allows a crafted crash report to be unpacked into a location outside the intended directory. The flaw is triggered when the report contains a base64‑encoded key that is skipped by ProblemReport.load(binary=False) and subsequently written out by ProblemReport.extract_keys() without validation. An attacker who can supply such a crash report can cause creation or overwriting of any file writable by the user running apport. This capability gives the attacker persistence or the means to execute code in the victim’s account by, for example, inserting malicious commands into .bashrc or .profile.

The vulnerability affects Canonical’s apport utility; all releases prior to 2.37.0 are susceptible. No additional vendor or product variants are listed.

The CVSS score of 5.7 indicates a medium severity consequence. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited or unknown real‑world exploitation. The likely attack vector requires the attacker to supply a crafted crash report to an instance of apport running under the target’s user account. The impact is confined to file creation or overwrite within the user’s writable space, but because it can modify shell startup files, it can lead to persistence or privilege‑level code execution within that user’s context.