{"api_version":"1","generated_at":"2026-10-31T15:20:41+00:00","cve":"CVE-2026-118599","urls":{"html":"https://cve.report/CVE-2026-118599","api":"https://cve.report/api/cve/CVE-2026-118599.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118599","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118599"},"summary":{"title":"epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install","description":"A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany >= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz","state":"PUBLISHED","assigner":"fedora","published_at":"2026-10-31 10:16:38","updated_at":"2026-10-31 10:16:38"},"problem_types":["CWE-59","CWE-59 Improper Link Resolution Before File Access ('Link Following')"],"metrics":[{"version":"3.1","source":"patrick@puiterwijk.org","type":"Secondary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118599","name":"https://access.redhat.com/security/cve/CVE-2026-118599","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248","name":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562969","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2562969","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988","name":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118599","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118599","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GNOME","product":"Epiphany","version":"affected 47.0 * semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-23T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-10-24T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Do not install WebExtensions (.xpi) from untrusted sources. Prefer keeping WebExtensions disabled when unused (Epiphany can refuse install when the feature is disabled in recent fixes). After any untrusted .xpi install attempt, inspect unexpectedly modified user files (for example shell startup files, autostart desktop entries, or SSH authorized_keys). Upgrade to a fixed Epiphany build containing MR !2248 / commit 0cc9ab55 when available for your stream.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Fernando Munoz for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://gitlab.gnome.org/GNOME/epiphany","defaultStatus":"unaffected","packageName":"epiphany","product":"Epiphany","vendor":"GNOME","versions":[{"lessThan":"*","status":"affected","version":"47.0","versionType":"semver"}]}],"credits":[{"lang":"en","value":"Red Hat would like to thank Fernando Munoz for reporting this issue."}],"datePublic":"2026-10-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany >= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz"}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","description":"Improper Link Resolution Before File Access ('Link Following')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-31T09:29:37.264Z","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","shortName":"fedora"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-118599"},{"name":"RHBZ#2562969","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562969"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248"}],"timeline":[{"lang":"en","time":"2026-10-23T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-24T00:00:00.000Z","value":"Made public."}],"title":"epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install","workarounds":[{"lang":"en","value":"Do not install WebExtensions (.xpi) from untrusted sources. Prefer keeping WebExtensions disabled when unused (Epiphany can refuse install when the feature is disabled in recent fixes). After any untrusted .xpi install attempt, inspect unexpectedly modified user files (for example shell startup files, autostart desktop entries, or SSH authorized_keys). Upgrade to a fixed Epiphany build containing MR !2248 / commit 0cc9ab55 when available for your stream."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-59: Improper Link Resolution Before File Access ('Link Following')"}},"cveMetadata":{"assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","assignerShortName":"fedora","cveId":"CVE-2026-118599","datePublished":"2026-10-31T09:29:37.264Z","dateReserved":"2026-10-28T16:47:14.805Z","dateUpdated":"2026-10-31T09:29:37.264Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-31 10:16:38","lastModifiedDate":"2026-10-31 10:16:38","problem_types":["CWE-59","CWE-59 Improper Link Resolution Before File Access ('Link Following')"],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118599","Ordinal":"1","Title":"epiphany: TAR-based .xpi with hard links can overwrite user file","CVE":"CVE-2026-118599","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118599","Ordinal":"1","NoteData":"A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany >= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz","Type":"Description","Title":"epiphany: TAR-based .xpi with hard links can overwrite user file"}]}}}