AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Red HatCVE-2026-74859

Red Hat Enterprise Linux: path traversal

Red Hat

CVE-2026-74859 · Published Sep 8, 2026 · updated Nov 6, 2026

Medium6.8
No fix yet
Red Hat advisory

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.

Affected versions

PackageAffectedFixed in
Red Hat Enterprise Linux 8
Product
all versionsNo fix yet
Red Hat Enterprise Linux 9
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More Red Hat advisories

All Red Hat
Low 3.3Sep 8Red Hat DPDK lib/vhost. Missing length validation: out-of-bounds readCVE-2026-86564no fix yetMedium 6.1Sep 8Red Hat gdk-pixbuf. This vulnerability: out-of-bounds readCVE-2026-18090no fix yetHigh 8.2Sep 8Red Hat build of Apache Camel - HawtIO 4: improper privilege managementCVE-2026-77968no fix yetCritical 9.9Sep 8Red Hat build of Apache Camel - HawtIO 4: improper certificate validationCVE-2026-78234no fix yetHigh 8.5Sep 8Red Hat libxml2 with Python bindings enabled: denial of serviceCVE-2026-74860no fix yetHigh 7.2Sep 8Red Hat Dogtag PKI: code executionCVE-2026-76561no fix yet