CVE-2026-118599
epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
CVE-2026-118599- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-06
EUVDEUVD-2026-114699
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
EUVD-2026-114699- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-h27g-h5mg-6hm2
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi...
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
GHSA-h27g-h5mg-6hm2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.
In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.
This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).
Requirements: the victim must install or open a malicious WebExtension (.xpi).
Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
CVE-2026-118599- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-118599
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
DEBIAN-CVE-2026-118599- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-118599
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz
- Record
UBUNTU-CVE-2026-118599- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12379-1 No score
epiphany-51.2-1.1 on GA media
These are all security issues fixed in the epiphany-51.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12379-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
epiphany-browserDebian:12 |
All versions, plus listed versions 43.1-144.0-144.1-144.2-144.3-1 Show 43 moreShow less44.5-144.5-244.6-144~rc-145.0-145.1-145.2-145~beta-146.0-146.0-246.1-146.2-146.3-146~alpha-146~beta-147.0-147.2-147~beta-147~rc-148.0-148.1-148.2-148.3-148.3-248.5-148.5-248.5-348~beta-148~rc-148~rc-249.0-149.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-251.0-151.1-151.2-151~rc-1 |
None known |
epiphany-browserDebian:13 |
All versions, plus listed versions 48.3-248.5-0+deb13u148.5-148.5-248.5-3 Show 13 moreShow less49.0-149.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-251.0-151.1-151.2-151~rc-1 |
None known |
epiphany-browserDebian:14 |
before 51.2-1, plus listed versions 48.3-248.5-148.5-248.5-349.0-1 Show 11 moreShow less49.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-251.0-151.1-151~rc-1 |
51.2-1 |
epiphany-browserUbuntu:16.04:LTS |
All versions, plus listed versions 3.16.3-1ubuntu13.18.0-1ubuntu23.18.1-1ubuntu13.18.3-0ubuntu13.18.5-0ubuntu13.18.5-0ubuntu1.13.18.10-0ubuntu13.18.11-0ubuntu1 |
None known |
epiphany-browserUbuntu:18.04:LTS |
All versions, plus listed versions 3.26.1-1ubuntu13.26.1-1ubuntu23.26.1-1ubuntu43.26.5.1-1ubuntu13.27.90-1ubuntu1 Show 4 moreShow less3.28.0.1-1ubuntu13.28.1-1ubuntu13.28.5-0ubuntu13.28.6-0ubuntu1 |
None known |
epiphany-browserUbuntu:20.04:LTS |
All versions, plus listed versions 3.34.1-13.34.1-1build13.36.0-13.36.1-13.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu13.36.4-0ubuntu2 |
None known |
epiphany-browserUbuntu:22.04:LTS |
All versions, plus listed versions 41.0-141.0-241.2-141.3-142~beta-1 Show 4 moreShow less42.0-142.1-142.1-1ubuntu142.4-0ubuntu1 |
None known |
epiphany-browserUbuntu:24.04:LTS |
All versions, plus listed versions 45.0-145.1-146~alpha-146~beta-146.0-146.0-2build146.5-0ubuntu1 |
None known |
epiphany-browserUbuntu:26.10 |
All versions, plus listed versions 49.2-3ubuntu150.4-150.4-2 |
None known |
epiphany-browserUbuntu:26.04:LTS |
All versions, plus listed versions 48.5-349.1-149.2-149.2-249.2-349.2-3ubuntu1 |
None known |
epiphanyopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 51.2-1.1 | 51.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118599 is a medium vulnerability (CVSS 5.5) in Gnome Epiphany, published October 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in epiphany-browser 51.2-1.