Published Corrective releases of APT Package Management Toolkit that remove vulnerability (CVE-2026-109518), which allows you to bypass verification when downloading files and have your code executed with root rights. A total of 13 releases have been created, covering all APT branches formed over the past 10 years, starting with 1.2.x. Package updates that fix the vulnerability have also already been generated for various versions of Debian and Ubuntu. In the default configuration, the issue affects all releases from Debian 12 and Ubuntu 22.04. Exploitation of older versions is possible if the Acquire::Retries parameter is set to a value greater than 0.
An attacker who is able to wedge HTTP traffic between the user and the package repository during package installation can achieve the installation of a spoofed, unverified version of the package, which allows him to gain root privileges on the system. An attack can be carried out, for example, through compromising mirrors, proxy servers, wireless access points or provider gateways. The vulnerability report does not mention details, only that the problem is caused by incorrect handling of hard links. Judging by patch, in which opening a file with the FileFd::Empty (O_TRUNC) flag is replaced with FileFd::Exclusive (O_EXCL), when By resuming an interrupted download, the attacker could overwrite data that had already been hashed during the first download.