qSnapper D-Bus Service Vulnerabilities Analysis: RACE, Path Traversal, Info Disclosure, Auth Bypass

--- Vulnerability Overview qSnapper: Multiple Security Issues in the Privileged D-Bus Service (CVE-2026-41045 to CVE-2026-41048) qSnapper is a GUI frontend for managing Btrfs filesystem snapshots. Its D-Bus service contains several security issues, including weaknesses in authentication checks, path traversal, information disclosure, and authentication cache bypasses. --- Scope of Impact Affected Versions: qSnapper 1.1.3 and earlier Affected Component: qSnapper D-Bus service Impacted Users: Local users (some vulnerabilities require administrator privileges) --- Vulnerability Details 1. Weak Polkit Authentication Check Vulnerable to Race Condition (CVE-2026-41045) Issue: The object is used for authentication checks, creating a race condition Impact: Polkit authentication checks can potentially be bypassed Fix: Switch to using the object 2. Path Traversal via configName Parameter (CVE-2026-41046) Issue: The parameter is passed directly to libsnapper without path validation Impact: Arbitrary writes may be possible, leading to DoS, information disclosure, etc. Fix: Validate and reject paths containing or 3. Information Disclosure via the "diff" Method (CVE-2026-41047) Issue: The Polkit operation allows local users to retrieve metadata changes for arbitrary files Impact: Sensitive information such as passwords or private keys may be leaked Fix: Restrict non-public information methods to only allow Polkit checks 4. Authentication Cache Leading to Bypass (CVE-2026-41048, CVE-2026-41049) Issue: Authentication flags are shared between clients, potentially allowing authentication bypass Impact: Unauthorized users may perform operations requiring administrator privileges Fix: Remove the authentication cache or implement independent authentication caches for each user and Polkit operation --- Remediation Upstream Fix: Patches addressing the above issues have been submitted Version Update: qSnapper 1.3.3 includes most of the fixes Additional Fixes: More complex defense-in-depth issues were resolved in qSnapper v1.3.4 --- Timeline 2026-04-09: GitHub issue created to contact security team 2026-04-13: Upstream developers responded and provided an email address 2026-04-15: Issues confirmed, coordinated disclosure requested 2026-04-17: CVEs assigned and shared with upstream 2026-05-26: Upstream released qSnapper 1.3.3 containing fixes 2026-05-26: This report published --- References qSnapper GitHub Repository qSnapper 1.3.3 Bugfix Release openSUSE Review Bug for qSnapper --- This summary covers the key information regarding qSnapper security issues from the page, including the vulnerability overview, scope of impact, specific vulnerability details, remediation steps, and timeline.

Goal Reached Thanks to every supporter — we hit 100%!

qSnapper D-Bus Service Vulnerabilities Analysis: RACE, Path Traversal, Info Disclosure, Auth Bypass