UBUNTU-CVE-2026-118599: Path Traversal
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread() used libarchive with archivereadsupportformatall() (and filters), so the installer did not require a real ZIP. A TAR file named .xpi was extracted. TAR supports hard-link entry types; with Epiphany's archivewritedisk options (including ARCHIVEEXTRACTPERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/mergerequests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/workitems/2988 Reporter acknowledgment: Fernando Munoz
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Epiphanyto a version that resolves this vulnerability.Patch 0cc9ab55
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Epiphany version 47.0 or later are exposed if they install or open a malicious WebExtension package with an .xpi filename. Exploitation is local and requires user interaction; no privileges are required.
What can a malicious extension package do?
A TAR archive disguised as an .xpi can use hard-link entries to truncate and overwrite an existing file that the user can write. The attacker controls the replacement content and file mode bits.
Are normal ZIP-based WebExtension packages affected?
The issue exists because the installer accepted archive formats beyond ZIP, including TAR. The upstream fix restricts supported package format handling to ZIP only.
What should be done if the fix cannot be applied immediately?
Do not install or open WebExtension .xpi files from untrusted sources. Treat unexpected or externally supplied .xpi files as potentially malicious, including files that appear to be extension packages but may actually be TAR archives.
How can I determine whether a system may be affected?
Check whether Epiphany is version 47.0 or later and whether users have installed or opened externally obtained .xpi packages. Systems using the change from commit 0cc9ab55, which enables only ZIP format support, contain the upstream fix.