GNOME Epiphany up to 47.0 WebExtension Installer ephy-web-extension-manager.c decompress_xpi_thread path traversal

Summaryinfo

A vulnerability classified as problematic was found in GNOME Epiphany up to 47.0. This impacts the function decompress_xpi_thread of the file src/webextension/ephy-web-extension-manager.c of the component WebExtension Installer. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-118599. The attack must be carried out locally. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in GNOME Epiphany up to 47.0 and classified as problematic. Affected by this issue is the function decompress_xpi_thread of the file src/webextension/ephy-web-extension-manager.c of the component WebExtension Installer. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity. CVE summarizes:

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-118599 since 10/28/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Applying the patch 0cc9ab55 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• GNOME

Name

• Epiphany

Version

• 47.0

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion