qSnapper CVE-2026-41047

Exploitation requires a local user session on a host where qSnapper before 1.3.3 is installed and its D-Bus service is running. The specific vulnerable surface is the set of four snapshot diff and change-listing D-Bus methods - GetFileChanges, GetFileChangesBetween, GetFileDiffBetween, and GetFileDiffAndDetails - which lacked any Polkit authorization check prior to v1.3.3. No special qSnapper configuration is required: the vulnerability is present in the default deployment whenever the D-Bus service is active. Exploitation is strictly limited to local vectors (AV:L); remote exploitation over the network is not possible. The attacker must be able to address the D-Bus bus on which qSnapper is running. What limits exploitation: the requirement for an existing local session, and that only confidentiality of snapshot diff data is at risk - there is no integrity or availability impact.

The CVSS 4.0 score of 6.9 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:H accurately characterizes this as a medium-severity local information disclosure. The primary risk limiter is the local attack vector (AV:L): exploitation requires an existing session on the target host and cannot be performed remotely. Within that constraint, exploitation complexity is trivial - no privileges are required (PR:N), no user interaction is needed (UI:N), and no special attack preconditions apply (AT:N). The confidentiality impact is high (VC:H), as the diff operations can expose file contents from snapshots that the local user would otherwise be denied by filesystem permissions. No EPSS data was provided, preventing quantitative probability assessment. There is no CISA KEV listing and no referenced POC, indicating this is not under active widespread exploitation at time of analysis. Realistic priority is elevated for multi-tenant or shared Linux systems where untrusted local users coexist with snapshot data containing sensitive files; on single-user workstations the practical risk is considerably lower.

A local unprivileged user on a Linux host running qSnapper before 1.3.3 uses a D-Bus client tool (e.g., dbus-send or gdbus) to directly invoke GetFileDiffBetween with two snapshot identifiers, receiving a full file diff in return without any authentication prompt appearing. The returned diff may include contents of files protected by filesystem ACLs that the calling user cannot read directly. No public proof-of-concept has been referenced, but the attack requires only basic D-Bus tooling knowledge and the interface method names, both of which are derivable from the qSnapper source.