CVE-2026-11853

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution

Medium · published June 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes) are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully user-controlled paths. The mergeuploads task could be abused to create arbitrary symbolic links on a worker, overwriting any file that the worker user has access to.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Published
2026-06-10T09:10Z
EPSS history
Timeline
  • 10 JUN 09:10Z
    Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution
    cvelistv5