CVE-2026-96424 Details

A vulnerability in the DBus policy for 'lomiri-upload-manager', part of 'lomiri-download-manager', allows any user to read files as root. This issue arises from incorrect DBus policy configuration, enabling unconfined applications to access the system bus instance of 'lomiri-upload-manager', which runs as root. The vulnerability affects all 'lomiri-download-manager' versions up to and including 0.3.2, as well as all Ubuntu Touch versions up to and including 24.04-1.4 and 24.04-2.0. When exploited, the 'createUpload' method can be used to specify a file path, which is then read by the daemon and uploaded to an attacker-controlled server via HTTP, without any authentication or authorization checks.

Users can update to 'lomiri-download-manager' version 0.3.3 or later. For Ubuntu Touch users, the device should be updated to version 24.04-2.1, 24.04-1.5, or later.