CVE-2026-74859

Public on 2026-09-08
Modified on 2026-09-08
Description
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2023 gnome-tweaks Not Affected
Amazon Linux 2027 Preview gnome-tweaks Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L