CVE-2026-41046CWE-23
path traversal via `config` parameter in qSnapper
High · published June 22, 2026
What it is
A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.
The record
Technical detail
- CVSS v3.1
- 7.3 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00185 · 7.7th percentile
- Weakness
- CWE-23 · Relative Path Traversal
- Published
- 2026-06-22T15:20Z
EPSS history
Timeline