qSnapper Privileged D-Bus Service Vulnerabilities Analysis (CVE-2026-41045 to 41048)

Here is a concise Markdown summary of the vulnerabilities in the web screenshot: --- Multiple Security Issues in qSnapper Privileged D-Bus Service (CVE-2026-41045 to CVE-2026-41048) Vulnerability Overview qSnapper is a GUI frontend for managing Btrfs filesystem snapshots. It relies on the tool and executes operations through a privileged D-Bus service ( ). This service runs with root privileges and provides the D-Bus interface , with some methods protected by Polkit authentication. Several security vulnerabilities were identified during the review, primarily involving: Race conditions in Polkit authentication checks Configuration file path traversal Information leakage (via the diff method) Authentication cache bypass Defense-in-depth issues when restoring arbitrary files --- Impact Scope CVE-2026-41045: Weak Polkit Authentication Check → Race Condition Impact: Attackers can bypass Polkit authentication by exploiting PID reuse, gaining local root privileges. Trigger: Exploiting the method enables full local privilege escalation. Fix: Use instead of for the subject. CVE-2026-41046: configName Parameter Path Traversal Impact: Allows writing to arbitrary paths or reading sensitive files (e.g., ), potentially leading to DoS, information disclosure, or ACL abuse. Trigger: Passing malicious paths to or other methods accepting . Fix: Validate and reject paths containing or . CVE-2026-41047: Information Disclosure via Diff Method Impact: Unauthenticated users can obtain differences in metadata or even file contents (e.g., ) for arbitrary files, leading to password or key leakage. Methods Involved: , , , , Fix: Restrict methods exposing non-public information to users only, or implement additional access controls. CVE-2026-41048 & CVE-2026-41049: Authentication Cache Bypass Impact: - Shared authentication status causes confusion between "delete-snapshot" and "rollback-snapshot" actions. - Single-interaction clients can be impersonated by other users, achieving local root privilege escalation. Fix: Remove the authentication cache, or bind independent caches to each user and Polkit action. Other Issues (No Independent CVE) allows restoring arbitrary files; if the target directory is writable (e.g., ), symlink attacks can be triggered. The method can be called by anyone, causing local DoS. Log file has overly permissive permissions, potentially leaking sensitive information. --- Remediation The upstream has released the following fixes: Version 1.3.3 (2026-05-26): - Replaced with (Fixes CVE-2026-41045) - Validated and rejected containing or (Fixes CVE-2026-41046) - Removed authentication cache (Fixes CVE-2026-41048/41049) - Rejected path traversal attempts (Fixes CVE-2026-41046) - Introduced Polkit action requiring authentication (Fixes CVE-2026-41047) - Removed unauthenticated method (Fixes other issues) - Changed log file permissions to writable only by root (Fixes other issues) Version 1.3.4 (Subsequent release): - Fixed path traversal issue in (Defense-in-depth issue) --- POC / Exploit Code > No directly executable POC code was provided on the page, but the exploitation path was described: > Note: Actual exploitation depends on the specific environment, permissions, and D-Bus interface calling methods. The above is purely conceptual. --- Timeline Summary 2026-04-09: Initial contact with upstream 2026-04-13: Received reply 2026-04-15: Vulnerability confirmed and CVEs assigned 2026-05-26: Upstream released fix version 1.3.3 2026-05-26: This report published --- References qSnapper GitHub Repository qSnapper 1.3.3 Release Notes openSUSE Review Bug --- ✅ All vulnerabilities have been fixed. It is recommended to upgrade to qSnapper ≥ 1.3.3.

Goal Reached Thanks to every supporter — we hit 100%!

qSnapper Privileged D-Bus Service Vulnerabilities Analysis (CVE-2026-41045 to 41048)