CVE-2026-96282

EUVD-2026-88044
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.46%
Debian logo
Debian Releases
Debian Product
Codename
flatpak
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1.18.2-1
fixed
sid
1.18.3-1
fixed
trixie
1.16.6-1~deb13u2
fixed
trixie (security)
1.16.6-1~deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
flatpak
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-96282
https://bugzilla.redhat.com/show_bug.cgi?id=2539422
https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f