Path Traversal in qSnapper Before Version 1.3.3

Executive Summary

CVE-2026-41046 is a path traversal vulnerability in the qsnapper software, specifically in the GetFileDiffAndDetails method. This method can be accessed by local interactive users without password authentication. The vulnerability occurs because the configName parameter can include slashes and ".." path components, allowing an attacker to select arbitrary files as configuration files for libsnapper.

This can lead to a major local information leak, a denial of service (DoS), or potentially escalate privileges to root.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a local attacker to cause a denial of service (DoS) on the affected system.

Additionally, it may enable an attacker to escalate their privileges to root, which would give them full control over the system.

It can also lead to a significant local information leak by accessing arbitrary configuration files.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the qsnapper software, specifically the `GetFileDiffAndDetails` method that uses the `configName` parameter. Detection involves checking if your system is running a vulnerable version of qsnapper (prior to 1.3.3) and monitoring for usage of the `GetFileDiffAndDetails` method with suspicious `configName` parameters containing path traversal sequences such as slashes and "..".

Since the vulnerability is local and involves path traversal in a parameter, you can detect attempts by auditing local command usage or scripts invoking qsnapper with unusual configName values.

Suggested commands to detect vulnerable versions and suspicious activity include:

• Check qsnapper version: `qsnapper --version` or `rpm -q qsnapper`
• Search for qsnapper processes or commands using suspicious configName parameters in shell history or process lists.
• Audit system logs for errors or crashes related to qsnapper that might indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade qsnapper to version 1.3.3 or later, where this path traversal vulnerability has been fixed.

Until the upgrade can be applied, restrict local user access to qsnapper to trusted users only, as the vulnerability requires local access.

Monitor and audit usage of qsnapper, especially the `GetFileDiffAndDetails` method, to detect and prevent exploitation attempts.

Useful 0 Not Useful 0