Bug 2529707

Summary:	CVE-2026-74859 gnome-tweaks: path traversal in theme installer [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Dhananjay Arunesh <darunesh>
Component:	gnome-tweaks	Assignee:	Mohamed El Morabity <pikachu.2014>
Status:	ASSIGNED ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	epel-packagers-sig, pikachu.2014
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["32f972fb-f960-49b6-b181-05d706fa1cd2"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2529702

Description Dhananjay Arunesh 2026-09-08 07:49:30 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Summary: Path traversal in theme installer
Requirements to exploit: user installs malicious gnome-shell theme
Component affected: ShellThemeInstallerTweak
Version affected: All versions
Patch available: Yes
Version fixed (if any already): Not yet
Upstream coordination: See issue report (below)
CVSS (optional):
Impact (optional):
Embargo: No
Acknowledgment: Zach Sylvester
Steps to reproduce if available: see issue report
Mitigation if available: do not use gnome-tweaks to install gnome-shell themes
Original report: https://gitlab.gnome.org/GNOME/gnome-tweaks/-/issues/542

Comment 1 Mohamed El Morabity 2026-10-18 02:03:08 UTC

No fix is available upstream yet: the issue (https://gitlab.gnome.org/GNOME/gnome-tweaks/-/issues/542) is still open and no merge request has been submitted on GitLab. I'll update the package once upstream addresses it. In the meantime, the mitigation is to avoid installing GNOME Shell themes from untrusted sources with gnome-tweaks.