Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118599— epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

Quick assessment

Affected
GNOME Epiphany
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Epiphany 浏览器在从 文件安装 WebExtension 扩展包时存在文件覆盖漏洞。 在 文件中， 函数使用了 库，并调用了 （包含相关过滤器），导致安装程序并不强制要求真实的 ZIP 格式。因此，一个名为 的 TAR 文件也能被正常解压。TAR 格式支持硬链接（hard-link）条目类型；结合 Epiphany 的 选项（包括 ），攻击者可构造特定的硬链接目标，在用户安装或打开恶意 文件时，将用户可写的现有文件截断，并用攻击者控制的内容及模式位进行覆盖，且全程不会弹出专门的警告对话框。 此漏洞与已修复的

CVSS 5.5 · Medium EPSS 0.18% · P8

Affected Version Matrix 1

VendorProduct Version RangeStatus
GNOME Epiphany 47.0< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118599

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
Source: CVE Program / CVE List V5
Vulnerability Description
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GNOME Epiphany 47.0 ~ * -

II. Public POCs for CVE-2026-118599

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118599

请登录查看更多情报信息。

Other References for CVE-2026-118599 (4)

IV. Related Vulnerabilities

Same product: Epiphany
Same vendor: GNOME
Same weakness: CWE-59