Quick answers
- Is CVE-2026-41046 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41046 being exploited in the wild.
- How severe is CVE-2026-41046?
- High severity, with a CVSS score of 7.3, published 22 June 2026.
- Which products and versions are affected?
- Presire qSnapper before 1.3.3.
- Is there a fix for CVE-2026-41046?
- A patch was published on 2026-05-25: Upstream version 1.3.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41046 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-41046?
- Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the D-Bus service of qSnapper due to insufficient validation of the 'configName' parameter. This parameter is passed to libsnapper without sanitization, allowing an attacker to use '../' sequences to reference arbitrary files on the filesystem as configuration files. Depending on the specific D-Bus method invoked, a local attacker can cause a denial of service (by pointing to device files like /dev/zero), leak sensitive information by forcing the parser to read files like /etc/shadow, or achieve privilege escalation when combined with other vulnerabilities like Polkit authentication bypasses. The issue is fixed in version 1.3.3 by implementing strict allowlist validation for configuration names.
Affected products
- presire qSnapper before 1.3.3
Timeline
- 2026-04-10: disclosed: Initial discovery by SUSE security team
- 2026-05-25: patched: Upstream version 1.3.3 released
- 2026-06-22: advisory: NVD and SUSE public disclosure