CVE-2026-96275

EUVD-2026-85342
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 47.55%
Debian logo
Debian Releases
Debian Product
Codename
flatpak
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1.18.4-1
fixed
sid
1.18.4-1
fixed
trixie
1.16.6-1~deb13u2
fixed
trixie (security)
1.16.6-1~deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
flatpak
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
flatpak
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-devel
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-remote-flathub
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-zsh-completion
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
libflatpak0
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
system-user-flatpak
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
typelib-1_0-Flatpak-1_0
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
flatpak
RHEL 8
0:1.12.9-7.el8_10
fixed
RHEL 9
0:1.12.9-4.el9_8.4
fixed
flatpak-devel
RHEL 8
0:1.12.9-7.el8_10
fixed
RHEL 9
0:1.12.9-4.el9_8.4
fixed
flatpak-libs
RHEL 8
0:1.12.9-7.el8_10
fixed
RHEL 9
0:1.12.9-4.el9_8.4
fixed
flatpak-selinux
RHEL 8
0:1.12.9-7.el8_10
fixed
RHEL 9
0:1.12.9-4.el9_8.4
fixed
flatpak-session-helper
RHEL 8
0:1.12.9-7.el8_10
fixed
RHEL 9
0:1.12.9-4.el9_8.4
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
flatpak
Amazon Linux 2
0:1.0.9-10.amzn2.0.8
fixed
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-builder
Amazon Linux 2
0:1.0.0-10.amzn2.0.8
fixed
flatpak-debuginfo
Amazon Linux 2
0:1.0.9-10.amzn2.0.8
fixed
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-debugsource
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-devel
Amazon Linux 2
0:1.0.9-10.amzn2.0.8
fixed
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-libs
Amazon Linux 2
0:1.0.9-10.amzn2.0.8
fixed
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-libs-debuginfo
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-selinux
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-session-helper
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-session-helper-debuginfo
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-tests
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
flatpak-tests-debuginfo
Amazon Linux 2023
0:1.18.1-1.amzn2023
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:80497
https://access.redhat.com/errata/RHSA-2026:80498
https://access.redhat.com/errata/RHSA-2026:80687
https://access.redhat.com/errata/RHSA-2026:89733
https://access.redhat.com/errata/RHSA-2026:90364
https://access.redhat.com/errata/RHSA-2026:92221
https://access.redhat.com/errata/RHSA-2026:92369
https://access.redhat.com/errata/RHSA-2026:95493
https://access.redhat.com/security/cve/CVE-2026-96275
https://bugzilla.redhat.com/show_bug.cgi?id=2539416
https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg