CVE-2026-96275

Summary

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob names from xa.extra-data-sources are not sanitized against .. traversal.

Affected Software

Weaknesses

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

Avoid installing Flatpak extensions from non-trusted sources.

References

• https://access.redhat.com/security/cve/CVE-2026-96275
• https://bugzilla.redhat.com/show_bug.cgi?id=2539416
• https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg

• ←Previous
• Next→