CVE-2026-97026

Summary

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-378: Creation of Temporary File With Insecure Permissions

Workarounds

Set a umask that does not allow other users to write to the cache directory, for example: umask 022.

Note that a umask that does not allow read/exec access by all (for example 027 or 077) will prevent the flatpak-system-helper from reading the temporary directory directly, resulting in falling back to copying the repository inefficiently, with a warning.

References