PatchTheCVEqsnapper vulnerabilities and fixes
Recent CVEs affecting qsnapper, with upgrade or downgrade steps. 5 tracked.
qsnapper has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-06-22. Highest priority: CVE-2026-41045 (score 30/100).
- CVE-2026-41045 HIGH 8.1 UPGRADE A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker
- CVE-2026-41046 HIGH 7.3 UPGRADE A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local a
- CVE-2026-41048 HIGH 7.1 UPGRADE Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed
- CVE-2026-41049 HIGH 7.1 UPGRADE Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3
- CVE-2026-41047 MEDIUM 5.5 UPGRADE Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a loc
FAQ
How do I fix qsnapper vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qsnapper being exploited right now?
None of the tracked qsnapper CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qsnapper CVE should I patch first?
CVE-2026-41045 currently ranks highest (30/100): A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker.