Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-92162Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

High 7.2

In plain English

A high-severity path traversal in flatpak from flatpak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12flatpakno fix listedDEBIAN-CVE-2026-92162
Debian:13flatpak1.16.6-1~deb13u3DEBIAN-CVE-2026-92162
Debian:14flatpak1.18.1-1DEBIAN-CVE-2026-92162
Ubuntu:26.04:LTSflatpakno fix listedUBUNTU-CVE-2026-92162

Affected products (as reported)

VendorProductVersions
flatpak flatpak < 1.18.1

Weakness: CWE-22 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References