CVE-2026-118599 | GNOME Epiphany up to 47.0 WebExtension Installer ephy-web-extension-manager.c decompress_xpi_thread path traversal (0cc9ab55)

October 31, 2026 Yanac

A vulnerability classified as problematic has been found in GNOME Epiphany up to 47.0. This affects the function decompress_xpi_thread of the file src/webextension/ephy-web-extension-manager.c of the component WebExtension Installer. This manipulation causes path traversal.

This vulnerability is tracked as CVE-2026-118599. The attack is restricted to local execution. No exploit exists.

To fix this issue, it is recommended to deploy a patch.VulDB Recent EntriesRead More