CVE-2026-74859 - Gnome-tweaks: path traversal in theme installer
Brief
CVE ID : CVE-2026-74859
Published : Sept. 8, 2026, 9:18 a. m.
- 1 hour, 31 minutes ago
Description : The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/. themes by using .. / path traversal, absolute paths, or symlink entries.
Severity: 6.8
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...