Oracle Bubblewrap Vulnerability Fixes Address Path Traversal Flaw

Linuxsecurity

Oracle Bubblewrap Vulnerability Fixes Address Path Traversal Flaw

First seen 21 Oct 2026, 16:08 UTC • •60.8

Article Content

1 / 4

Browse articles

ThreatCluster •October 21, 2026 at 17:09 UTC

•CVE-2026-87766 is a critical path traversal vulnerability affecting Oracle Bubblewrap.
•Multiple updates have been released for Oracle Linux 8, 9, and 10 to address this flaw.
•Administrators are advised to apply the patches immediately to prevent potential server code execution.

Oracle has released multiple updates for its Bubblewrap tool to address a path traversal vulnerability identified as CVE-2026-87766. This flaw affects self-managed GitLab installations, potentially allowing unauthorized server code execution. The vulnerability was published on September 9, 2026, with a CVSS score of 8.8, categorizing it as high severity. The updates include versions 0.6.3-1.1 for Oracle Linux 9, 0.10.0-5 for Oracle Linux 10, and 0.4.0-3 for Oracle Linux 8. Administrators are urged to apply these patches immediately to mitigate risks. The vulnerability is associated with symlinked mount targets and improper directory traversal during setup, making it for users to update their systems promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-09

CVE-2026-87766 published

Oracle disclosed a critical path traversal vulnerability in Bubblewrap with a CVSS score of 8.8.

2026-10-21

Patch updates released

Oracle released updates for Bubblewrap across multiple Oracle Linux versions to fix CVE-2026-87766.

More articles in this cluster (3)

Threat Graph

5 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Vulnerability (2)

CVE-2026-87766
Path Traversal

Weakness (1)

CWE-22 - Path Traversal

Affected Platform (2)

Linux
Oracle Linux

Relationships

CVE-2026-87766 targets Linux
CVE-2026-87766 targets Oracle Linux
Path Traversal targets Linux
Path Traversal targets Oracle Linux
CVE-2026-87766 related to CWE-22 - Path Traversal

Following this threat?

Track CVE-2026-87766 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which versions of Oracle Linux are affected?

The vulnerability affects Oracle Linux 8, 9, and 10, specifically the Bubblewrap tool.

What is the severity of CVE-2026-87766?

CVE-2026-87766 has a CVSS score of 8.8, categorizing it as high severity.

What should I do to protect my systems?

Apply the latest updates for Bubblewrap as soon as possible to mitigate the vulnerability.

Continue Reading

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…

Critical WordPress Vulnerability CVE-2026-87902 Exploited Within Hours of Disclosure On September 22, 2026, WordPress released version 7.1.2 to address a critical vulnerability, CVE-2026-87902, which allows unauthenticated attackers to exploit a path traversal flaw in the page-template resolution process. This vulnerability, which affects WordPress versions 4.7.0 through 7.1.1, has a CVSS score of…