CVE-2026-96282
3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
Workarounds
Avoid installing Flatpak extensions from non-trusted sources.
References
- https://access.redhat.com/security/cve/CVE-2026-96282
- https://bugzilla.redhat.com/show_bug.cgi?id=2539422
- https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.