CVE-2026-21436
Medium
Description
eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be installed in the path given by `--destdir`, but on a different location on the host. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.
SeverityMedium
CVSS5.5
Exploit probability—
ProductGetsol Eopkg
PublishedJan 1, 2026
First seenJan 1, 2026
Weakness typeCWE-24CWE-24
How to fix
Update
- getsol eopkg4.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getsol eopkg | v < 4.4.0 | 4.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.