The shell theme installer in gnome-tweaks on Red Hat Enterprise Linux 8 improperly limits pathname validation when extracting user-supplied ZIP archives. This allows crafted theme archives to perform path traversal attacks by including ../ sequences, absolute paths, or symlink entries, enabling files to be written outside the ~/.themes directory. The vulnerability requires local user interaction to install a malicious theme deliberately. Red Hat rates this vulnerability as Moderate due to the requirement for user action and limited attack surface in typical desktop environments. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H with a score of 6.8. The impact includes potential unauthorized code execution, file modification, reading sensitive files, and denial of service by corrupting critical files. Red Hat has not yet published an official fix or remediation guidance for this issue.

An attacker who convinces a user to install a specially crafted GNOME Shell theme can cause files to be created or overwritten outside the intended directory, potentially leading to unauthorized code execution, modification of critical files, exposure of sensitive data, or denial of service by corrupting important files. The vulnerability affects confidentiality (low impact), integrity (high impact), and availability (high impact). Exploitation requires local user privileges and user interaction, limiting the scope of the threat.

Red Hat has not provided an official fix or remediation level for this vulnerability yet. Exploitation requires deliberate user installation of a malicious GNOME Shell theme, so avoiding installation of untrusted themes is a key mitigation. Monitor the Red Hat advisory page for updates and patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.