CVE-2026-5656: Wireshark Path Traversal Vulnerability

CVE-2026-5656 Overview

CVE-2026-5656 is a path traversal vulnerability in the profile import functionality of Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. An attacker who convinces a user to import a crafted configuration profile can write files outside the intended profile directory. This can lead to denial of service and possible code execution on the local system. The Wireshark Foundation published advisory WNPA-SEC-2026-21 documenting the issue, which is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
A maliciously crafted Wireshark profile archive can traverse the filesystem during import, overwrite arbitrary files accessible to the user, and potentially achieve local code execution.

Affected Products

Wireshark 4.6.0 through 4.6.4
Wireshark 4.4.0 through 4.4.14
Installations on Windows, macOS, and Linux that expose the profile import feature

Discovery Timeline

2026-05-01 - CVE-2026-5656 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-5656

Vulnerability Analysis

Wireshark allows users to share configuration profiles by exporting and importing archive files. The import routine extracts entries from the archive into the user's personal configuration directory. The vulnerable versions fail to properly sanitize entry names contained in the archive. An attacker can embed path components such as ../ in entry names. During extraction, the resolved path escapes the intended profile directory and writes to arbitrary filesystem locations the user can access.

Exploitation requires user interaction. The victim must open Wireshark and choose to import the attacker-supplied profile archive. Successful writes to startup directories, Lua plugin folders, or shell configuration files can result in local code execution the next time the affected program starts.

Root Cause

The root cause is improper validation of pathnames during profile archive extraction, mapped to [CWE-22]. The import logic concatenates archive entry names with the destination directory without canonicalizing the result or rejecting entries containing .. segments or absolute paths. This violates the principle that file extraction must constrain output paths to a known root.

Attack Vector

The attack vector is local and requires user interaction, consistent with the CVSS metrics for this issue. An attacker delivers a crafted profile archive through email, chat, a forum post, or a shared network location. The victim imports the profile through the Wireshark UI, at which point the traversal executes with the privileges of the user running Wireshark. No network access to the victim is required by the attacker. The vulnerability is described in detail in the Wireshark Security Advisory WNPA-SEC-2026-21 and the corresponding GitLab Wireshark Issue.

Detection Methods for CVE-2026-5656

Indicators of Compromise

Wireshark profile archive files (.zip or similar) sourced from untrusted locations
Files written outside the user's Wireshark personal configuration directory shortly after a profile import action
Unexpected Lua scripts appearing under the Wireshark plugins directory or user init.lua
Modifications to shell startup files, autostart entries, or Wireshark preferences immediately following profile import

Detection Strategies

Monitor Wireshark process file-write activity and alert when child writes occur outside the expected profile directory tree
Inspect imported profile archives for entries whose normalized paths resolve outside the archive root or contain .. traversal sequences
Correlate Wireshark execution events with creation of executable or script files in user autostart locations

Monitoring Recommendations

Enable endpoint logging of file creation and modification events for the user's Wireshark configuration directory
Track installation and version inventory for Wireshark to identify hosts still running 4.6.0–4.6.4 or 4.4.0–4.4.14
Review email and web gateway telemetry for inbound profile archives matching Wireshark export naming conventions

How to Mitigate CVE-2026-5656

Immediate Actions Required

Upgrade Wireshark to a fixed release as documented in WNPA-SEC-2026-21
Do not import Wireshark profile archives received from untrusted or unverified sources
Audit endpoints to identify analyst workstations running affected versions and prioritize them for patching
Restrict write permissions on shared analyst systems so a compromised user account cannot modify system-wide locations

Patch Information

The Wireshark Foundation has published fixed builds and source releases. Refer to the Wireshark Security Advisory WNPA-SEC-2026-21 for the exact fixed versions and download links. The upstream fix is tracked in the GitLab Wireshark Issue #21115.

Workarounds

Avoid using the profile import feature until the host is patched
Manually inspect the contents of any profile archive before import and reject archives containing .. or absolute paths in entry names
Run Wireshark under a least-privilege user account dedicated to packet analysis to limit the scope of any successful traversal

bash

# Verify the installed Wireshark version on Linux/macOS
wireshark --version | head -n 1

# Inspect a profile archive for path traversal entries before import
unzip -l suspicious_profile.zip | awk '{print $4}' | grep -E '(^/|\.\./)'