qSnapper Privilege Escalation & LPE Vulnerabilities (CVE-2026-41045-41049) Analysis

Here is the concise Chinese Markdown summary of the vulnerabilities in the webpage screenshot: --- Multiple Security Issues in qSnapper Privileged D-Bus Service (CVE-2026-41045 to CVE-2026-41048) Vulnerability Overview qSnapper is a GUI frontend for managing Btrfs filesystem snapshots, which relies on a D-Bus service running with root privileges. This service exposes multiple methods; while some are protected by Polkit authentication, several security flaws exist, including: Weak Polkit authentication checks: Vulnerable to PID reuse attacks when using the subject (CVE-2026-41045) Path traversal vulnerability: The parameter is not validated, allowing arbitrary configuration file loading (CVE-2026-41046) Information disclosure: The method allows unauthenticated users to read sensitive file differences (CVE-2026-41047) Authentication cache bypass: Authentication state is incorrectly shared, leading to privilege escalation (CVE-2026-41048, CVE-2026-41049) Lack of defense in depth when restoring arbitrary files: Can trigger symlink attacks (No independent CVE) Impact Scope Local attackers: Can exploit path traversal, information disclosure, and authentication bypass vulnerabilities without authentication. Privileged operations: Attackers can perform arbitrary file writes, read sensitive data (e.g., ), and even obtain a root shell. Affected versions: qSnapper 1.1.3 and earlier; patched versions are 1.3.3 (with bug fixes) and 1.3.4 (with defense in depth fixes). Remediation Upstream has released the following fixes: CVE-2026-41045 (Weak Polkit Authentication) Changed from using to subject to avoid PID reuse. CVE-2026-41046 (Path Traversal) Validated the parameter, rejecting paths containing or . CVE-2026-41047 (Information Disclosure) Added an check to the method to restrict unauthenticated access. CVE-2026-41048 & CVE-2026-41049 (Authentication Cache Bypass) Removed the authentication caching mechanism or bound independent caches to each Polkit action. Defense in Depth Issue (No CVE) Added checks for path components in to prevent symlink attacks. Changed log files to be writable only by root ( ). POC / Exploit Code > No complete POC code block was provided on the page, but the exploitation methods were described: Path Traversal Exploit Example (Pseudocode): Information Disclosure Exploit Example (Pseudocode): Authentication Bypass Exploit Example (Pseudocode): --- ✅ Final Patched Versions: qSnapper 1.3.3 (with main vulnerability fixes) and 1.3.4 (with defense in depth fixes). 📅 Disclosure Timeline: First contact on April 9, 2026 → CVEs assigned on July 17, 2026 → Patched versions released on May 26, 2026. --- Note: The above summary is distilled from the original content, omitting non-core information such as navigation, ads, and footers.

Goal Reached Thanks to every supporter — we hit 100%!

qSnapper Privilege Escalation & LPE Vulnerabilities (CVE-2026-41045-41049) Analysis