Executive brief
PackageKit is a system service that allows users to manage software packages. A security flaw in its API allows an attacker to determine if specific files exist on the system, even if those files are in protected directories that the user should not be able to see. This could be used by a malicious actor to gather information about the system's configuration or installed software to plan further attacks.
Technical details
A vulnerability exists in PackageKit's `SetHints` D-Bus method within `src/pk-transaction.c`. The function `pk_transaction_set_hint` processes the `frontend-socket` parameter using `g_file_test()` with the `G_FILE_TEST_EXISTS` flag. Because PackageKit typically runs with root privileges, `g_file_test()` follows symbolic links as root. An unprivileged attacker can provide a path to a symlink pointing to a restricted file; if the method returns success, the target file exists, and if it returns a "does not exist" error, the file is absent. This creates a side-channel oracle for arbitrary file probing. The vulnerability is reachable via the D-Bus system bus.
Affected products
- PackageKit PackageKit up to 1.3.5
Timeline
- 2026-05-11: disclosed: Issue reported on PackageKit GitHub repository
- 2026-06-01: advisory: CVE-2026-10294 published