CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Enterprise Linux 8

This vulnerability arises because the shell theme installer in gnome-tweaks on Red Hat Enterprise Linux 8 extracts user-supplied ZIP archives without properly validating the paths of the archive members. An attacker can craft a theme archive that uses path traversal sequences (e.g., ../), absolute paths, or symbolic links to write files outside the intended ~/.themes directory. Successful exploitation requires user interaction in the form of deliberately installing a malicious GNOME Shell theme, which restricts the scope of potential attacks.

An attacker who convinces a user to install a malicious GNOME Shell theme can cause files to be written outside the expected theme directory, potentially leading to unauthorized file modification or privilege escalation. The vulnerability impacts confidentiality, integrity, and availability to varying degrees as indicated by the CVSS vector (C:L/I:H/A:H). However, the need for user interaction limits the attack vector.

No explicit patch or remediation status is provided in the available data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-74859 for current remediation guidance. Until a fix is applied, users should avoid installing GNOME Shell themes from untrusted sources to mitigate exploitation risk.