CVE-2026-11853

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes) are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully user-controlled paths. The mergeuploads task could be abused to create arbitrary symbolic links on a worker, overwriting any file that the worker user has access to.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Debian	debusine	>= 0.12.0, < 0.14.9

References

Timeline

Published: Jun 10, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1185305.0The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user m CVE-2026-1185313.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own au CVE-2026-1185326.5The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachme CVE-2026-1185334.3The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user request CVE-2026-1185344.3The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order target CVE-2026-1185374.3A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.CVE-2026-1185385.5A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0 CVE-2026-1185396.5Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 CVE-2026-118546.1The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitizatio CVE-2026-1185405.3Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.CVE-2026-1185414.3Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.CVE-2026-1185422.7Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.