Vulnerability · Published Sep 27, 2026 · Assigned by redhat
CVE-2026-96282Flatpak: flatpak: extension metadata path traversal file existence oracle
Low 3.1
In plain English
A low-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-96282 |
| Debian:13 | flatpak | 1.16.6-1~deb13u2 | DEBIAN-CVE-2026-96282 |
| Debian:14 | flatpak | 1.18.1-1 | DEBIAN-CVE-2026-96282 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-96282 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-96282 vdb-entry, x_refsource_REDHAT
- RHBZ#2539422 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f