Description

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-08T09:18:20.960Z",
  "pubdate": "2026-09-08T09:18:20.960Z",
  "executiveSummary": "The gnome-tweaks utility contains a critical path traversal vulnerability within its shell theme installer component. This flaw arises from the insecure extraction of user-supplied ZIP archives, where the application fails to perform necessary validation on archive member paths. By crafting a malicious ZIP archive, an attacker can bypass intended directory constraints and write files to arbitrary locations on the host file system.\nThe vulnerability allows for file writes outside the designated ~/.themes directory via the inclusion of path traversal sequences (../), absolute file paths, or symbolic link entries within the archive structure. The primary impact of this flaw is unauthorized file system modification, which can lead to arbitrary code execution, privilege escalation, or persistence, depending on the attacker's ability to overwrite sensitive system configuration files or user-specific startup scripts. The exploit requires user interaction in the form of triggering the theme installation process. Consequently, this vulnerability represents a significant security risk for desktop environments where untrusted theme archives might be processed by the user.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of archive extraction logic within the gnome-tweaks shell theme installer. When the utility processes a ZIP archive, it fails to sanitize or validate the file paths of individual members before performing file system write operations. This deficiency in input validation permits the extraction process to follow directory traversal directives embedded within archive filenames.\nExploitation is achieved through the construction of a malicious ZIP archive containing specially crafted entry names. An attacker can utilize several techniques to escape the target directory: 1) Path Traversal: Including ../ sequences in file paths to traverse upward in the directory hierarchy from the intended extraction destination. 2) Absolute Paths: Providing paths that start with the root directory (/), forcing the installer to attempt a write to sensitive system locations. 3) Symbolic Link Injection: Creating an archive member that acts as a symlink pointing to an arbitrary location; if the installer follows these links during extraction, it effectively redirects the payload target.\nThe attack flow proceeds as follows: First, the attacker distributes a seemingly legitimate shell theme archive containing malicious payload files. Second, the victim is prompted to install this theme using gnome-tweaks. Third, the utility's vulnerable extraction component processes the archive, failing to check for path sanity. Fourth, the application attempts to write the malicious file at the attacker-specified path. If successful, the attacker can overwrite critical user-owned files, such as ~/.bashrc, ~/.ssh/authorized_keys, or other configuration files that influence system or application behavior.\nThis vulnerability is localized to the theme installation routine of gnome-tweaks. It does not require network exposure to exploit, as it relies on the victim locally processing an attacker-provided file. No complex authentication is required beyond the user's initial interaction to trigger the installation. The post-exploitation impact is limited by the privileges of the user running gnome-tweaks; however, in many desktop environments, compromising the user's home directory is sufficient to achieve full user-level compromise, which may serve as a precursor to further system-wide exploitation."
}