Is CVE-2026-41047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41047 being exploited in the wild.

How severe is CVE-2026-41047?

Informational severity, with a CVSS score of 6.9, published 22 June 2026.

Is there a fix for CVE-2026-41047?

A patch was published on 2026-05-25: Upstream release 1.3.3 published with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41047 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-41047?

Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41047: presire qSnapper information disclosure in snapshot diff functions

CVE-2026-41047 · Severity: info · CVSS 6.9 · Published 2026-06-22

qSnapper, a graphical tool for managing Btrfs system snapshots, contains a vulnerability that allows local users to view sensitive files without proper authorization. By using the "snapshot diff" feature, an unprivileged user can compare different versions of system files, such as password databases or private configuration files, which are normally restricted. This could lead to the exposure of administrative credentials or other private system data.

Technologies: Presire qSnapper. Vendors: Presire.

Quick answers

Is CVE-2026-41047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41047 being exploited in the wild.
How severe is CVE-2026-41047?: Informational severity, with a CVSS score of 6.9, published 22 June 2026.
Which products and versions are affected?: Presire qSnapper before 1.3.3.
Is there a fix for CVE-2026-41047?: A patch was published on 2026-05-25: Upstream release 1.3.3 published with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41047 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-41047?: Check whether you run Presire qSnapper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in qSnapper before version 1.3.3 within its D-Bus service. The 'list-snapshots' Polkit action was incorrectly applied to sensitive methods including GetFileChanges, GetFileDiffAndDetails, GetFileChangesBetween, and GetFileDiffBetween, allowing locally logged-in users to execute them without administrative credentials. An attacker can exploit this to perform diff operations on restricted files (e.g., /etc/shadow) across different snapshots, effectively bypassing filesystem permissions to leak sensitive data. The issue was resolved in version 1.3.3 by introducing a new 'view-diff' Polkit action that requires administrative authentication.

Affected products

presire qSnapper before 1.3.3

Timeline

2026-04-10: disclosed: Initial discovery and report by SUSE security team
2026-05-25: patched: Upstream release 1.3.3 published with fixes
2026-06-22: advisory: CVE-2026-41047 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.