CVE-2026-11853

Name of the Vulnerable Software and Affected Versions Debusine (affected versions not specified)

Description Debusine uses a parser to read Debian source packages (.dsc) and upload artifacts (.changes), which are manifest files listing the components of an artifact. This parser accepts arbitrary paths controlled by the user. Consequently, the mergeuploads task can be exploited to create arbitrary symbolic links on a worker, allowing the overwriting of any file accessible to the worker user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.