# CVE-2026-41046: presire qSnapper path traversal in configName parameter

Source: https://junglewise.ai/threats/cve-2026-41046-presire-qsnapper-path-traversal-in-configname-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-41046 · Severity: high · CVSS 7.3 · Published 2026-06-22

qSnapper is a graphical tool used to manage Btrfs filesystem snapshots on Linux systems. A security flaw allows a local user to trick the system into using malicious configuration files by manipulating file paths. This could allow an attacker to crash the service, access sensitive system information, or potentially gain full administrative (root) control over the computer.

Technologies: [Presire qSnapper](https://junglewise.ai/threats/technologies/qsnapper). Vendors: [Presire](https://junglewise.ai/threats/vendors/presire).

## Quick answers

**Is CVE-2026-41046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41046 being exploited in the wild.

**How severe is CVE-2026-41046?** High severity, with a CVSS score of 7.3, published 22 June 2026.

**Which products and versions are affected?** Presire qSnapper before 1.3.3.

**Is there a fix for CVE-2026-41046?** A patch was published on 2026-05-25: Upstream version 1.3.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41046 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-41046?** Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the D-Bus service of qSnapper due to insufficient validation of the 'configName' parameter. This parameter is passed to libsnapper without sanitization, allowing an attacker to use '../' sequences to reference arbitrary files on the filesystem as configuration files. Depending on the specific D-Bus method invoked, a local attacker can cause a denial of service (by pointing to device files like /dev/zero), leak sensitive information by forcing the parser to read files like /etc/shadow, or achieve privilege escalation when combined with other vulnerabilities like Polkit authentication bypasses. The issue is fixed in version 1.3.3 by implementing strict allowlist validation for configuration names.

## Affected products

- presire qSnapper before 1.3.3

## Timeline

- 2026-04-10: disclosed: Initial discovery by SUSE security team
- 2026-05-25: patched: Upstream version 1.3.3 released
- 2026-06-22: advisory: NVD and SUSE public disclosure

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=1261889](https://bugzilla.suse.com/show_bug.cgi?id=1261889)
- [https://github.com/presire/qSnapper/releases/tag/v1.3.3](https://github.com/presire/qSnapper/releases/tag/v1.3.3)
- [https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html](https://security.opensuse.org/2026/05/26/qsnapper-dbus-issues.html)

## Related threats

- [presire qSnapper authentication bypass via shared auth caching](https://junglewise.ai/threats/cve-2026-41049-presire-qsnapper-authentication-bypass-via-shared-auth-caching)
- [presire qSnapper authentication bypass via shared m_authenticated flag](https://junglewise.ai/threats/cve-2026-41048-presire-qsnapper-authentication-bypass-via-shared-m-authenticated)
- [presire qSnapper information disclosure in snapshot diff functions](https://junglewise.ai/threats/cve-2026-41047-presire-qsnapper-information-disclosure-in-snapshot-diff)
- [presire qSnapper Polkit authentication bypass via TOCTOU race condition](https://junglewise.ai/threats/cve-2026-41045-presire-qsnapper-polkit-authentication-bypass-via-toctou-race)