CVE-2026-109518 with a CVSS score of 7.7 is a high-severity file-check bypass in the APT package manager used by Linux systems, affecting version 26.10. The flaw occurs in the HTTP acquisition backend when APT downloads .deb packages and handles retries after failed downloads. An on-path attacker who controls the network path or operates a malicious mirror can intercept package downloads, issue HTTP redirects and server errors, and force the client to retry. During the retry process, APT mishandles file checks and overwrites existing hardlinks with an attacker-controlled file, allowing a package to be installed even after signature verification fails. Because package installation scripts execute with root privileges, successful exploitation can lead to remote code execution with full root control on the affected host. The vulnerability affects tools that use the HTTP backend, including apt, apt-get, and aptitude, while HTTPS or FTP links and snap packages are not subject to the same on-path network attack. Business impact includes potential compromise of servers and cloud hosts that rely on APT for software installation, enabling attackers to install malicious packages, obtain root control, and disrupt operations.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-109518 with a CVSS score of 7.7 is a high-severity file-check bypass in the APT package manager used by Linux systems, affecting version 26.10. The flaw occurs in the HTTP acquisition backend when APT downloads .deb packages and handles retries after failed downloads. An on-path attacker who controls the network path or operates a malicious mirror can intercept package downloads, issue HTTP redirects and server errors, and force the client to retry. During the retry process, APT mishandles file checks and overwrites existing hardlinks with an attacker-controlled file, allowing a package to be installed even after signature verification fails. Because package installation scripts execute with root privileges, successful exploitation can lead to remote code execution with full root control on the affected host. The vulnerability affects tools that use the HTTP backend, including apt, apt-get, and aptitude, while HTTPS or FTP links and snap packages are not subject to the same on-path network attack. Business impact includes potential compromise of servers and cloud hosts that rely on APT for software installation, enabling attackers to install malicious packages, obtain root control, and disrupt operations.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]