Vulnerability · Published Sep 29, 2026 · Assigned by redhat
CVE-2026-97024Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
High 7.1
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | flatpak | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| AlmaLinux:10 | flatpak-devel | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-devel | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak-devel | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| AlmaLinux:10 | flatpak-libs | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-libs | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:10 | flatpak-selinux | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-selinux | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:10 | flatpak-session-helper | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-session-helper | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak-session-helper | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-97024 |
| Debian:13 | flatpak | 1.16.6-1~deb13u3 | DEBIAN-CVE-2026-97024 |
| Debian:14 | flatpak | 1.18.4-1 | DEBIAN-CVE-2026-97024 |
| Rocky Linux:10 | flatpak | 0:1.16.0-9.el10_2.6 | RLSA-2026:89849 |
| Rocky Linux:8 | flatpak | 0:1.12.9-9.el8_10 | RLSA-2026:89859 |
| Rocky Linux:9 | flatpak | 0:1.12.9-4.el9_8.6 | RLSA-2026:89850 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-97024 |
| Ubuntu:26.10 | flatpak | no fix listed | UBUNTU-CVE-2026-97024 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-61 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
References
- RHSA-2026:89849 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89850 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89859 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95061 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95062 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95063 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95064 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-97024 vdb-entry, x_refsource_REDHAT
- RHBZ#2542625 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf