diff --git a/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml
new file mode 100644
index 000000000..bbc18db42
--- /dev/null
+++ b/modules/bases/debian_bookworm_desktop_kde_unpatched/secgen_metadata.xml
@@ -0,0 +1,31 @@
+
+
+
+ Debian 12 Bookworm Desktop (unpatched kernel): PROXMOX ONLY
+ Z. Cliffe Schreuders
+ GPLv3
+ Debian 12 Bookworm Desktop KDE amd64, pinned to the pre-patch template so the kernel remains
+ vulnerable to CVE-2026-46331 (pedit COW). Proxmox only. Select this base only with a base module_path
+ filter of .*/debian_bookworm_desktop_kde_unpatched -- the distro string is intentionally not "Debian 12"
+ so generic base filters never match it.
+ 64-bit
+ desktop
+
+ linux
+ unix
+ Bookworm amd64 unpatched-kernel (module_path-only, PROXMOX)
+ https://app.vagrantup.com/secgen/boxes/bookworm-base/versions/1.0.1/providers/virtualbox/amd64/download/vagrant.box
+ https://app.vagrantup.com/redwiz666/boxes/debian_stretch_desktop_kde/versions/1.0.0/providers/vmware.box
+ buster_desktop_kde_20230615
+ bookworm-desktop-kde-20241114
+
+ https://atlas.hashicorp.com/puppetlabs
+ various
+
+
+
+ bases/.*
+
+
diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp
new file mode 100644
index 000000000..321ae818d
--- /dev/null
+++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/manifests/config.pp
@@ -0,0 +1,46 @@
+class pedit::config {
+ $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
+ $strings_to_leak = $secgen_parameters['strings_to_leak']
+ $leaked_filenames = $secgen_parameters['leaked_filenames']
+
+ $binpath = ['/bin', '/usr/bin', '/sbin', '/usr/sbin']
+
+ file { '/etc/sysctl.d/99-pedit-userns.conf':
+ ensure => present,
+ owner => 'root',
+ group => 'root',
+ mode => '0644',
+ content => "kernel.unprivileged_userns_clone = 1\nuser.max_user_namespaces = 15000\n",
+ }
+
+ exec { 'pedit-apply-userns-sysctl':
+ command => 'sysctl -w kernel.unprivileged_userns_clone=1 ; sysctl -w user.max_user_namespaces=15000',
+ provider => 'shell',
+ path => $binpath,
+ require => File['/etc/sysctl.d/99-pedit-userns.conf'],
+ }
+
+ exec { 'pedit-unblacklist-act-pedit':
+ command => "sed -i '/act_pedit/d' /etc/modprobe.d/*.conf",
+ provider => 'shell',
+ path => $binpath,
+ onlyif => 'grep -rlq act_pedit /etc/modprobe.d/',
+ }
+
+ exec { 'pedit-hold-kernel':
+ command => 'apt-mark hold linux-image-amd64 "linux-image-$(uname -r)"',
+ provider => 'shell',
+ path => $binpath,
+ unless => 'apt-mark showhold | grep -q linux-image',
+ }
+
+ ::secgen_functions::leak_files { 'pedit-flag-leak':
+ storage_directory => '/root',
+ leaked_filenames => $leaked_filenames,
+ strings_to_leak => $strings_to_leak,
+ owner => 'root',
+ group => 'root',
+ mode => '0600',
+ leaked_from => 'pedit',
+ }
+}
diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp
new file mode 100644
index 000000000..ead7038d9
--- /dev/null
+++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/pedit.pp
@@ -0,0 +1 @@
+include pedit::config
diff --git a/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml
new file mode 100644
index 000000000..69a1db0c5
--- /dev/null
+++ b/modules/vulnerabilities/unix/access_control_misconfigurations/pedit/secgen_metadata.xml
@@ -0,0 +1,54 @@
+
+
+
+ act_pedit Kernel Privilege Escalation (pedit_cow)
+ Alix Hiscock
+ MIT
+ Prepares a host for local privilege escalation through the kernel net/sched act_pedit
+ action. Unprivileged user namespaces are enabled so a local user can gain CAP_NET_ADMIN in a
+ namespace, the act_pedit module is left loadable (not blacklisted), and the vulnerable kernel is
+ held back from being upgraded. A root-owned flag is leaked so the intended escalation can be
+ demonstrated end to end.
+
+ access_control_misconfiguration
+ root_rwx
+ local
+ linux
+
+ high
+
+ strings_to_leak
+ leaked_filenames
+
+
+
+
+
+
+
+
+ The kernel exposes act_pedit to unprivileged user namespaces and has been pinned to a
+ vulnerable version. Gain CAP_NET_ADMIN in a user namespace and abuse the tc pedit action.
+ Escalate to root via the act_pedit kernel flaw reachable through unprivileged user
+ namespaces, then read the flag from /root.
+
+
+ .*/debian_bookworm_desktop_kde_unpatched
+
+
+
+ access control
+ Elevated privileges
+ Vulnerabilities and attacks on access control misconfigurations
+
+
+ Access controls and operating systems
+ Linux security model
+
+
+ CVEs and CWEs
+
+
+
diff --git a/scenarios/ctf/pedit.xml b/scenarios/ctf/pedit.xml
new file mode 100644
index 000000000..34f96add2
--- /dev/null
+++ b/scenarios/ctf/pedit.xml
@@ -0,0 +1,113 @@
+
+
+
+
+ Pedit
+ Alix Hiscock
+ Hack the web_server from kali.
+
+
+ ctf
+ attack-ctf
+ pwn-ctf
+ medium
+
+
+ server-side misconfiguration and vulnerable components
+ Directory traversal
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+
+ access control
+ Elevated privileges
+ Vulnerabilities and attacks on access control misconfigurations
+
+
+ Access controls and operating systems
+ Linux security model
+
+
+
+ attack_vm
+
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+ {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}
+
+
+
+
+
+ {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+
+
+ spoiler_admin_pass
+
+
+
+
+
+ web_server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+ spoiler_admin_pass
+
+
+
+
+