Exploit for CVE-2026-25828

Name: Exploit for CVE-2026-25828
Rating: 5 (194 reviews)

2026-02-06 | CVSS 5.8

## https://sploitus.com/exploit?id=C11B456E-99D7-5E3C-AEC4-EF098C92DCFF
# CVE-2026-25828 - Command Injection in grub-btrfs initramfs hook

## Vulnerability Details
- **CVE ID**: CVE-2026-25828
- **CVSS**: 9.8 (Critical)
- **Vendor**: Arch Linux  
- **Product**: grub-btrfs
- **Versions**: All versions up to 2026-01-31
- **Discovered**: 2026-01-31
- **Discovered by**: cardosource

## Description
Command injection vulnerability in grub-btrfs package for Arch Linux. The initramfs hook `grub-btrfs-overlayfs` passes the `$root` kernel parameter without sanitization to `resolve_device()`, allowing arbitrary command execution as root during boot.