CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Enterprise Linux 8

The vulnerability in Red Hat Enterprise Linux 8's gnome-tweaks shell theme installer arises from improper validation of archive member paths when extracting ZIP archives. This flaw allows a crafted theme archive to perform path traversal attacks, writing files outside the ~/.themes directory by leveraging ../ sequences, absolute paths, or symbolic links. Exploitation requires user interaction, specifically the installation of a malicious GNOME Shell theme via gnome-tweaks. The vulnerability impacts confidentiality, integrity, and availability by potentially allowing unauthorized file creation or modification, reading sensitive files, or causing denial of service through corruption or deletion of critical files. Red Hat classifies this as a moderate risk due to the required user action and limited attack surface in typical desktop environments.

An attacker who convinces a user to install a specially crafted GNOME Shell theme can write files outside the intended directory, potentially overwriting or creating critical files. This can lead to unauthorized code execution, modification of important files, exposure of sensitive data, or denial of service by corrupting or deleting critical files. However, exploitation requires user interaction and deliberate installation of the malicious theme, which limits the risk in typical Red Hat desktop environments.

Red Hat rates this vulnerability as moderate and notes that exploitation requires deliberate user action to install a malicious theme. No official fix or patch status is provided in the advisory content. Users should avoid installing untrusted GNOME Shell themes via gnome-tweaks. Monitor Red Hat's advisory page for updates on patches or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.