REDHAT-BUG-2529702: Path Traversal

Published Sep 8, 2026

Updated

Summary: Path traversal in theme installer Requirements to exploit: user installs malicious gnome-shell theme Component affected: ShellThemeInstallerTweak Version affected: All versions Patch available: Yes Version fixed (if any already): Not yet Upstream coordination: See issue report (below) CVSS (optional): Impact (optional): Embargo: No Acknowledgment: Zach Sylvester Steps to reproduce if available: see issue report Mitigation if available: do not use gnome-tweaks to install gnome-shell themes Original report: https://gitlab.gnome.org/GNOME/gnome-tweaks/-/issues/542

Affected Software

1 affected component

Gnome gnome-tweaks

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Do not use gnome-tweaks to install GNOME Shell themes (risk of path traversal in ShellThemeInstallerTweak when a user installs a malicious theme).

Event History

Sep 8, 2026

Data Sourced

via Red Hat·07:43 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which environments are exposed?

Any environment using GNOME Tweaks to install GNOME Shell themes is potentially exposed. The affected ShellThemeInstallerTweak component is listed as affected in all versions.

What must an attacker do to exploit this issue?

The attacker must persuade or otherwise cause a user to install a malicious GNOME Shell theme using GNOME Tweaks.

What should teams do if they cannot apply a patch immediately?

Do not use GNOME Tweaks to install GNOME Shell themes until the issue is addressed.

Is a fixed release identified?

A patch is reported as available, but no specific fixed version is identified.