Vulnerability · Published Sep 28, 2026 · Assigned by redhat
CVE-2026-97023Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
High 7.1
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | flatpak | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| AlmaLinux:10 | flatpak-devel | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-devel | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak-devel | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| AlmaLinux:10 | flatpak-libs | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-libs | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:10 | flatpak-selinux | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-selinux | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:10 | flatpak-session-helper | 1.16.0-9.el10_2.6 | ALSA-2026:89849 |
| AlmaLinux:8 | flatpak-session-helper | 1.12.9-9.el8_10 | ALSA-2026:89859 |
| AlmaLinux:9 | flatpak-session-helper | 1.12.9-4.el9_8.6 | ALSA-2026:89850 |
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-97023 |
| Debian:13 | flatpak | 1.16.6-1~deb13u3 | DEBIAN-CVE-2026-97023 |
| Debian:14 | flatpak | 1.18.4-1 | DEBIAN-CVE-2026-97023 |
| Rocky Linux:10 | flatpak | 0:1.16.0-9.el10_2.6 | RLSA-2026:89849 |
| Rocky Linux:8 | flatpak | 0:1.12.9-9.el8_10 | RLSA-2026:89859 |
| Rocky Linux:9 | flatpak | 0:1.12.9-4.el9_8.6 | RLSA-2026:89850 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-97023 |
| Ubuntu:26.10 | flatpak | no fix listed | UBUNTU-CVE-2026-97023 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-61 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
References
- RHSA-2026:89849 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89850 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89859 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95061 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95062 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95063 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:95064 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-97023 vdb-entry, x_refsource_REDHAT
- RHBZ#2542606 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54