Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Epiphany's WebExtension XPI installer. When extracting a .xpi archive, decompress_xpi_thread() in ephy-web-extension-manager.c passed archive entry pathnames directly to libarchive without ARCHIVE_EXTRACT_SECURE_NODOTDOT or ARCHIVE_EXTRACT_SECURE_SYMLINKS. A crafted XPI containing path traversal sequences (../) could write files outside the intended web_extensions extraction directory to arbitrary locations writable by the user, potentially leading to code execution on next login or shell start. Fixed upstream in epiphany 50.6 and 49.9 (GitLab MR !2143).