CVE-2026-74859: gnome-tweaks Path Traversal Vulnerability

CVE-2026-74859 Overview

CVE-2026-74859 is a path traversal vulnerability in the gnome-tweaks shell theme installer. The installer extracts user-supplied ZIP archives without validating archive member paths. A crafted theme archive can write files outside the intended ~/.themes directory using ../ sequences, absolute paths, or symbolic link entries. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An attacker who convinces a user to install a malicious theme archive can overwrite arbitrary files in the user's home directory, leading to code execution in the user's session.

Affected Products

GNOME Tweaks (gnome-tweaks) shell theme installer component
Linux distributions packaging vulnerable versions of gnome-tweaks
Red Hat Enterprise Linux (see Red Hat CVE-2026-74859)

Discovery Timeline

2026-09-08 - CVE-2026-74859 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-74859

Vulnerability Analysis

The gnome-tweaks shell theme installer accepts a ZIP archive from the user and unpacks it into ~/.themes. The unpacking routine iterates over archive members and writes each one to the destination directory without verifying that the resolved path stays within that directory. This is a classic Zip Slip pattern.

Exploitation requires local access and user interaction. A victim must select and install a malicious theme archive through the Tweaks interface. Successful exploitation grants the attacker write access to any file the user can modify, including shell startup files, .desktop autostart entries, and SSH configuration.

Root Cause

The extractor does not canonicalize archive member names before joining them to the destination path. Three attack primitives result: relative traversal using ../ components, absolute paths that ignore the destination base, and symlink entries that redirect subsequent writes to arbitrary filesystem locations. See the Red Hat Bug Report #2529702 for the upstream discussion.

Attack Vector

An attacker distributes a crafted .zip theme through a community forum, chat channel, or theme repository. When the victim installs the theme through gnome-tweaks, malicious archive entries write outside ~/.themes. Writing to ~/.bashrc, ~/.config/autostart/, or ~/.ssh/authorized_keys yields code execution or persistent access in the user's session.

Because the installer runs as the invoking user, impact is scoped to that account rather than root. Refer to the vendor advisory for technical details on the affected extraction routine.

Detection Methods for CVE-2026-74859

Indicators of Compromise

Files in ~/.themes archives whose entry names contain ../ sequences, leading slashes, or symbolic link targets pointing outside the extraction directory.
Unexpected modifications to shell initialization files (~/.bashrc, ~/.profile, ~/.zshrc) shortly after a user installs a GNOME shell theme.
New or modified entries under ~/.config/autostart/ that were not created by a package manager or a legitimate application.
Additions to ~/.ssh/authorized_keys that correlate with recent gnome-tweaks activity.

Detection Strategies

Inspect user-supplied theme archives with unzip -l or python3 -m zipfile -l and flag any entries containing .., absolute paths, or symlinks.
Monitor process ancestry for file writes originating from gnome-tweaks that resolve outside ~/.themes.
Alert on file integrity changes to shell startup files, autostart directories, and SSH configuration on Linux workstations.

Monitoring Recommendations

Enable Linux audit rules (auditd) to log open and openat syscalls with paths matching ~/.bashrc, ~/.ssh/, and ~/.config/autostart/.
Forward workstation file integrity events to a central SIEM for correlation with theme installation activity.
Track download and execution of .zip archives from untrusted sources in browser and endpoint telemetry.

How to Mitigate CVE-2026-74859

Immediate Actions Required

Update gnome-tweaks to the patched version supplied by your Linux distribution.
Do not install GNOME shell themes from untrusted sources until the update is applied.
Audit ~/.themes, ~/.config/autostart/, and shell startup files on multi-user workstations for unauthorized modifications.

Patch Information

Consult your distribution's security tracker for fixed package versions. Red Hat customers should reference the Red Hat CVE-2026-74859 advisory for errata and package availability. Apply vendor updates through the standard package manager (dnf, apt, zypper) once the fixed version is published.

Workarounds

Install themes manually by extracting the archive with unzip into a temporary directory and inspecting the contents before copying files into ~/.themes.
Reject any theme archive whose entries contain .., absolute paths, or symbolic links.
Restrict the use of gnome-tweaks theme installation on shared or high-value systems until patches are deployed.

bash

# Inspect a theme archive for traversal or symlink entries before installing
unzip -l suspicious-theme.zip | awk '{print $4}' | grep -E '^/|\.\./|^$'
zipinfo suspicious-theme.zip | grep -E '^l' # symlink entries