SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-74859

MEDIUM · CVSS 6.8 EPSS 0.13%

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The shell theme installer in gnome-tweaks is vulnerable due to improper validation of user-supplied ZIP archives, allowing attackers to exploit path traversal, absolute paths, or symlink entries to write files outside the intended ~/.themes directory. This could lead to unauthorized file manipulation or system compromise. Users and administrators of gnome-tweaks should prioritize addressing this vulnerability to mitigate potential security risks.

CVE
CVE-2026-74859
Severity
MEDIUM
CVSS
6.8
EPSS
0.13%

Original NVD Description

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.