https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 11:28:18 +0000 https://db.gcve.eu/vuln/cve-2026-118599 <p><strong>Affected:</strong> GNOME Epiphany</p> <p>A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.</p> <p>In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany&#39;s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.</p> <p>This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).</p> <p>Requirements: the victim must install or open a malicious WebExtension (.xpi).</p> <p>Affected: Epiphany &gt;= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz</p> <p><strong>Affected:</strong> GNOME Epiphany</p> <p>A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.</p> <p>In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany&#39;s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.</p> <p>This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).</p> <p>Requirements: the victim must install or open a malicious WebExtension (.xpi).</p> <p>Affected: Epiphany &gt;= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz</p> https://db.gcve.eu/vuln/cve-2026-118599