qSnapper Privileged D-Bus Service CVE-2026-41045 to 41049 Vulnerability Analysis and Fixes

--- Multiple Security Issues in qSnapper's Privileged D-Bus Service (CVE-2026-41045 to CVE-2026-41048) Vulnerability Overview qSnapper is a GUI frontend for managing Btrfs filesystem snapshots. It runs a backend daemon named with root privileges to execute operations. This service exposes multiple methods via the D-Bus interface and relies on Polkit for access control. A security audit revealed several critical vulnerabilities, including authentication bypass, path traversal, information disclosure, and arbitrary file recovery. --- Affected Scope Affected Versions: qSnapper 1.1.3 and earlier (the report is based on version 1.1.3, but the upstream has patched issues up to version 1.3.3) Attacker Preconditions: Local user (no authentication required or only low privileges needed) Potential Consequences: - Complete local root privilege escalation (via authentication bypass + path traversal) - Sensitive information leakage (e.g., , private keys, log contents) - Denial of Service (DoS) - Arbitrary file write/overwrite (via the method) --- Remediation Upstream developers have accepted the recommendations and fixed the following issues: ✅ Fixed Vulnerabilities (see qSnapper 1.3.3): 1. CVE-2026-41045: Weak Polkit authentication check → switched to using the principal to avoid race conditions. 2. CVE-2026-41046: Path traversal → validated the parameter, rejecting paths containing or . 3. CVE-2026-41047: Information disclosure → restricted the method to users with privileges; added the action which requires authentication. 4. CVE-2026-41048 & 41049: Authentication cache bypass → removed the authentication caching mechanism; each Polkit action is now verified independently. 5. Other Hardening: - now rejects path traversal attempts. - The method was removed (previously callable by any user, leading to DoS). - Log files are no longer world-readable. > Note: Some "defense-in-depth" issues (such as restoring arbitrary files) were not fixed in version 1.3.3 and will be addressed in a future release (v1.3.4). --- POC / Exploit Code (from original source) 1. Path Traversal Exploit Example (CVE-2026-41046) 2. Information Disclosure Exploit Example (CVE-2026-41047) 3. Authentication Bypass Exploit Example (CVE-2026-41048/41049) 4. Defense-in-Depth Issue Example (Post-CVE-2026-41049) --- Timeline and Disclosure Process 2026-04-09: Initial contact with upstream developers 2026-04-13: Detailed report provided 2026-04-15: Vulnerabilities confirmed and CVEs assigned 2026-05-26: Upstream released patch version qSnapper 1.3.3 2026-05-26: This report made public --- References qSnapper GitHub Repository qSnapper 1.3.3 Release Notes openSUSE Review Bug --- > Report Authors: Matthias Gerstner, Filippo Bonazzi > Publication Date: May 26, 2026 > Original Review Version: qSnapper 1.1.3 → Current Patched Version: 1.3.3

Goal Reached Thanks to every supporter — we hit 100%!

qSnapper Privileged D-Bus Service CVE-2026-41045 to 41049 Vulnerability Analysis and Fixes