---
id: "CVE-2026-96424"
kind: "vulnerability"
aliases: ["CVE-2026-96424"]
title: "Lomiri upload manager: DBus policy lets any user read root files"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "lomiri-download-manager", "fixed": ["0.3.3"], "affected": ">= 0.1.0, <= 0.3.2", "ecosystem": "linux"}, {"name": "ubuntu-touch", "fixed": ["24.04-1.5", "24.04-2.1"], "affected": "<= 24.04-1.4, 24.04-2.0", "ecosystem": "linux"}]
ecosystems: []
tags: ["dbus", "infrastructure", "linux", "local-privilege", "lomiri", "lomiri-download-manager", "ubuntu-touch", "unconfined-apps"]
not_affected_if: ["apparmor-confined-apps-only", "patched-0.3.3"]
published_at: "2026-10-16T16:22:52+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:46:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96424", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:46:48+00:00"}]
---

# Lomiri upload manager: DBus policy lets any user read root files

The system-bus instance of lomiri-upload-manager runs as root, and its DBus policy lets any local user call it. An unconfined local app can make it read any root-readable file and POST the contents to a URL the attacker picks. AppArmor-confined Ubuntu Touch apps cannot reach it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:lomiri-download-manager affected >= 0.1.0, <= 0.3.2 fixed 0.3.3
- linux:ubuntu-touch affected <= 24.04-1.4, 24.04-2.0 fixed 24.04-1.5, 24.04-2.1

## How to check

Check the installed lomiri-download-manager version (for example dpkg -l lomiri-download-manager); 0.3.2 or older is affected. On Ubuntu Touch, a build older than 24.04-2.1 (or 24.04-1.5 on the 1.x line) is affected. Vendor does not give a test command.

## Fix

Update lomiri-download-manager to 0.3.3 or newer (covers lomiri-upload-manager). On Ubuntu Touch, update to 24.04-2.1 or 24.04-1.5. The fix locks the system-bus DBus policy so arbitrary users cannot reach the service.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96424
- 2026-10-25T03:46:48+00:00 analyst — Read UBports advisory (primary), issue #18, NVD/CVE record. Affected <=0.3.2, fixed 0.3.3; Ubuntu Touch 24.04-2.1/1.5. No PoC link or exploitation reported; sibling CVE-2026-96425 (download-manager command exec). How-to-check is my own derivation, not vendor text, so unverified.

## Documents

- [advisory] UBports security advisory: lomiri-download-manager / upload-manager https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager
- [describes] Issue #18: unauthenticated arbitrary-file-read-as-root in lomiri-upload-manager https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18
- [fix] Fix commit 779dfd5b https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa

## From the sources

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_