EUVD-2026-38263
GHSA-3hfq-9fxf-h35p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Local D-Bus access requires an unprivileged local account so PR:L (not PR:N); low complexity, no UI; high availability from DoS, low C/I from config-driven side effects short of confirmed full RCE.
Primary rating from Vendor (suse).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.
AnalysisAI
Local privilege escalation and denial of service in qSnapper before 1.3.3 stems from path traversal via the configName D-Bus parameter, allowing local attackers to point the snapper backend at attacker-controlled config files. Per the SUSE security review that produced coordinated fixes for CVE-2026-41045 through CVE-2026-41049, exploitation can crash the service or escalate to root through abuse of snapper configuration handling. No public exploit identified at time of analysis, but the upstream advisory and Bugzilla entry document the issue in detail.
Technical ContextAI
qSnapper is a Qt-based front-end and D-Bus service for snapper, the Btrfs/ext4 snapshot management tool widely used on openSUSE/SLES. The vulnerability is a CWE-23 relative path traversal in the configName argument accepted by multiple D-Bus methods: the service did not constrain the value to a snapper config identifier, so '..' sequences and unexpected characters allowed selecting arbitrary files as a snapper config. Because qSnapper's privileged D-Bus methods ultimately invoke snapper as root, controlling the config path translates into root-level file/process behavior. The 1.3.3 release introduces validateConfigName() enforcing the allowlist regex ^[A-Za-z0-9_.-]+$ at every D-Bus entry point accepting configName.
RemediationAI
Vendor-released patch: qSnapper 1.3.3 - upgrade immediately via the project release at https://github.com/presire/qSnapper/releases/tag/v1.3.3 or the distribution package once published per SUSE Bugzilla 1261889. The 1.3.3 fix adds validateConfigName() with an ^[A-Za-z0-9_.-]+$ allowlist applied at every D-Bus method that accepts configName and is bundled with related D-Bus hardening (CVE-2026-41045/47/48/49) that should be taken together. If upgrading is not immediately possible, restrict access to the com.presire.qsnapper D-Bus service by tightening the D-Bus policy file so only trusted administrative users can invoke its methods, or stop and mask the qSnapper service on multi-user systems; the trade-off is that legitimate non-admin users will lose snapshot management functionality until patched.
Authentication bypass in qSnapper's privileged D-Bus service (versions before 1.3.3) allows any local unprivileged user
Local privilege escalation in qSnapper D-Bus service before version 1.3.3 allows any unprivileged local user to invoke p
Local privilege escalation in presire qSnapper before 1.3.3 lets a low-privileged user bypass Polkit authentication in t
Unauthenticated local access to qSnapper's D-Bus snapshot diff interface before version 1.3.3 exposes read-protected fil
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today