{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Fernando Munoz for reporting this issue.", "bugzilla": {"description": "epiphany: epiphany: path traversal in WebExtension XPI extraction (ZIP slip)", "id": "2520891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520891"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A path traversal (ZIP slip) vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\nIn src/webextension/ephy-web-extension-manager.c, the decompress_xpi_thread() function extracts XPI archives (ZIP format) to disk using libarchive. For each archive entry, the output path is built by concatenating the intended extraction directory with the raw pathname from the archive:\nfull_path = g_build_filename(path, archive_entry_pathname(entry), NULL);\narchive_entry_set_pathname(entry, full_path);\nret = archive_write_header(ext, entry);\nThe libarchive extraction options did not include ARCHIVE_EXTRACT_SECURE_NODOTDOT or ARCHIVE_EXTRACT_SECURE_SYMLINKS. As a result, archive entries containing parent-directory traversal sequences (for example \"../../../../../.bashrc\") are written outside the intended web_extensions extraction directory.\nA malicious .xpi file can therefore overwrite arbitrary files writable by the user running Epiphany, such as ~/.bashrc, ~/.config/autostart/*.desktop, or ~/.ssh/authorized_keys. This can lead to persistent code execution on subsequent shell startup or GNOME login.\nExploitation requires the victim to install or open a crafted .xpi file. The reporter notes that opening an XPI can trigger extraction even when the WebExtensions feature is not enabled by default.\nAffected versions: Epiphany >= 47.rc.\nFixed upstream in epiphany 50.6 and 49.9 via merge request !2143, which adds ARCHIVE_EXTRACT_SECURE_NODOTDOT and ARCHIVE_EXTRACT_SECURE_SYMLINKS to archive_write_disk_set_options().\nUpstream report: https://gitlab.gnome.org/GNOME/epiphany/-/issues/2922"], "mitigation": {"lang": "en:us", "value": "Upgrade to epiphany 50.6, 49.9, or later. Do not install untrusted .xpi WebExtension packages until patched."}, "name": "CVE-2026-77679", "public_date": "2026-08-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77679\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77679\nhttps://gitlab.gnome.org/GNOME/epiphany/-/issues/2922\nhttps://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2143"], "statement": "A path traversal flaw was found in Epiphany's WebExtension XPI installer. When a user installs a crafted .xpi extension package, unsafe archive entry pathnames are extracted outside the intended directory, allowing arbitrary file overwrite in locations writable by the user. An attacker could use this flaw to modify startup scripts, autostart entries, or SSH authorized keys, potentially achieving persistent code execution. Users should upgrade to a fixed Epiphany version and avoid installing untrusted WebExtension packages.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[47.rc,49.9)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "epiphany", "vendor": "gnome"}], "created": "2026-08-25T13:30:17.400963+00:00", "updated": "2026-08-25T14:15:05.820972+00:00", "vendors": ["gnome", "gnome$PRODUCT$epiphany"]}