Vulnerability · Published Sep 23, 2026 · Assigned by redhat
CVE-2026-96275Flatpak: flatpak: arbitrary write access as root via extra-data extraction
High 8.8
In plain English
A high-severity path traversal in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | flatpak | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-devel | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-devel | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-devel | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-libs | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-libs | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-libs | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-selinux | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-selinux | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-selinux | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-session-helper | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-session-helper | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-session-helper | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-96275 |
| Debian:13 | flatpak | 1.16.6-1~deb13u2 | DEBIAN-CVE-2026-96275 |
| Debian:14 | flatpak | 1.18.1-1 | DEBIAN-CVE-2026-96275 |
| Rocky Linux:10 | flatpak | 0:1.16.0-9.el10_2.4 | RLSA-2026:80498 |
| Rocky Linux:8 | flatpak | 0:1.12.9-7.el8_10 | RLSA-2026:80687 |
| Rocky Linux:9 | flatpak | 0:1.12.9-4.el9_8.4 | RLSA-2026:80497 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-96275 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2026:80497 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80498 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80687 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89733 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:90364 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:92221 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:92369 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95493 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-96275 vdb-entry, x_refsource_REDHAT
- RHBZ#2539416 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg