Lomiri Download Manager: Incorrect DBus policy allows local root file read

Summary

An incorrect DBus policy lets any local user reach the system-bus instances of lomiri-download-manager and lomiri-upload-manager. The download manager can then run arbitrary commands as root after a download, and the upload manager can read arbitrary files as root and send them to an attacker-controlled server. The attacker needs local access and an account or app on the device, and most Ubuntu Touch apps are confined by AppArmor, which limits the risk.

Affected

• lomiri-download-manager up to and including 0.3.2 (vendor advisory; the CVE record lists the range as 0.1.0 to below 0.3.3)
• Ubuntu Touch up to and including 24.04-1.4 and 24.04-2.0

Fixed in

• lomiri-download-manager 0.3.3 (released 13 September 2026)
• Ubuntu Touch 24.04-2.1 and 24.04-1.5
• Fix commit 779dfd5bbeb5fe8877627b772e5024e40eda38aa

Workaround

• No documented workaround for other distributions.
• The vendor fix locks down the system-level services with DBus policy and disables post-download command execution for the system-level download manager.
• On Ubuntu Touch, only install apps from trusted publishers, especially unconfined apps.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Update lomiri-download-manager to 0.3.3 or later, or install the patched package from your distribution.
• On Ubuntu Touch, update to 24.04-2.1, 24.04-1.5 or later.
• Check whether Ubuntu Touch devices or Lomiri desktop installations are in use; if not, no further action is needed.
• Only install applications from trusted sources.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• UBports security advisory forums.ubports.com
• Fix commit 779dfd5 gitlab.com
• Upstream work item 18 gitlab.com
• Ubuntu security tracker ubuntu.com
• OSV record osv.dev
• NVD mirror (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:51.