CVE-2026-41046 Overview
CVE-2026-41046 is a path traversal vulnerability in qSnapper versions prior to 1.3.3. The flaw resides in the handling of the configName parameter, which is passed to the underlying snapper utility without proper sanitization. A local attacker can supply a crafted configName value that references attacker-controlled configuration files outside the expected directory. Because snapper operations run with elevated privileges through D-Bus, loading a malicious configuration can trigger denial of service or privilege escalation to root. The vulnerability is classified under CWE-23 (Relative Path Traversal).
Critical Impact
Local attackers can escalate privileges to root by tricking qSnapper into loading attacker-controlled snapper configuration files via the configName parameter.
Affected Products
- qSnapper versions prior to 1.3.3
- openSUSE distributions packaging vulnerable qSnapper builds
- Systems exposing the qSnapper D-Bus interface to unprivileged users
Discovery Timeline
- 2026-06-22 - CVE-2026-41046 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-41046
Vulnerability Analysis
qSnapper provides a Qt-based front-end to snapper, the SUSE filesystem snapshot management tool. The application accepts a configName parameter that identifies which snapper configuration to operate against. Versions before 1.3.3 fail to validate this parameter against path traversal sequences. An attacker can supply values containing ../ segments or absolute paths to reference configuration files outside the intended /etc/snapper/configs/ directory.
Because snapper configurations define commands and hooks that execute during snapshot operations, loading an attacker-controlled file allows code execution in the privileged context of the qSnapper D-Bus service. The CVSS vector indicates local access with low attack complexity and no privileges required.
Root Cause
The root cause is insufficient input validation on the configName parameter. The application concatenates user-supplied input into a filesystem path without normalizing path separators, stripping traversal sequences, or constraining lookups to a whitelisted directory. This pattern matches CWE-23, where relative path components allow access beyond the intended directory boundary.
Attack Vector
A local user with access to the qSnapper D-Bus interface invokes a method that accepts configName. The attacker first plants a malicious snapper configuration file in a directory they control. They then call qSnapper with a configName value containing traversal sequences pointing at that file. qSnapper loads the malicious configuration and executes the attacker-defined snapper hooks or commands as root, completing the privilege escalation. The vulnerability mechanism is described in the openSUSE Security Analysis.
No verified public proof-of-concept code is available. Technical details are documented in the SUSE Bug Report #1261889.
Detection Methods for CVE-2026-41046
Indicators of Compromise
- Unexpected snapper configuration files appearing outside /etc/snapper/configs/
- D-Bus method calls to qSnapper containing ../ or absolute path sequences in the configName argument
- Snapper hook executions originating from non-standard configuration paths
- Root-owned processes spawned by the qSnapper service with unusual command lines
Detection Strategies
- Audit D-Bus traffic to the qSnapper service and flag configName values containing path separators or traversal sequences
- Monitor process ancestry for snapper invocations whose configuration argument resolves outside /etc/snapper/configs/
- Inspect installed qSnapper versions across Linux endpoints and identify hosts running builds earlier than 1.3.3
Monitoring Recommendations
- Enable Linux audit rules on /etc/snapper/configs/ and user-writable directories that could host planted configurations
- Forward D-Bus and auditd logs to a centralized analytics platform for correlation with privilege escalation patterns
- Alert on root command execution chained from the qSnapper D-Bus service when the configuration source is non-standard
How to Mitigate CVE-2026-41046
Immediate Actions Required
- Upgrade qSnapper to version 1.3.3 or later on all affected systems
- Restrict access to the qSnapper D-Bus interface to trusted administrative accounts only
- Review existing snapper configuration directories for unauthorized files
Patch Information
The upstream fix is included in qSnapper 1.3.3, which validates the configName parameter and rejects path traversal sequences. Patched binaries and source are available in the GitHub Release v1.3.3. Distribution-specific updates are tracked in the SUSE Bug Report #1261889.
Workarounds
- Remove or disable the qSnapper D-Bus service on systems where it is not required
- Apply polkit rules that restrict invocation of qSnapper methods to administrative users
- Mount user-writable filesystems with noexec to limit the impact of planted configuration scripts
# Verify installed qSnapper version and upgrade on openSUSE
rpm -q qSnapper
sudo zypper refresh
sudo zypper update qSnapper
# Confirm the patched version is active
qsnapper --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
