Skip to main content

Flatpak EUVDEUVD-2026-85342

| CVE-2026-96275 HIGH
Path Traversal (CWE-22)
2026-09-23 secalert@redhat.com
Linux Path Traversal
8.8
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts/compromises Flatpak remote
  2. Delivery
    Victim installs or updates extra-data app
  3. Exploit
    extract_extra_data resolves files/extra via symlink
  4. Execution
    Unsanitized '..' blob name escapes target dir
  5. Persist
    Write attacker content to arbitrary path as root
  6. Impact
    Full host compromise

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the victim to install or update an application that uses the Flatpak extra-data mechanism (xa.extra-data-sources) from a malicious or attacker-compromised remote (UI:R - user-initiated install/update). Full impact (arbitrary write as root) requires a system install rather than a per-user install. The vulnerability depends on two combining conditions in extract_extra_data(): files/extra being resolved through symlink-following path operations, and blob names not being sanitized against '..' traversal. Limiting factors: user interaction is mandatory, the target app must actually use extra-data, and root-level impact requires the system-wide installation path.
Impact

High-priority issue. CVSS 3.1 base is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and the vector is credible: a malicious or compromised Flatpak repository can drive an arbitrary-location filesystem write via extract_extra_data(), and on system installs that write executes as root - effectively arbitrary root-owned file placement, which maps cleanly to the full C:H/I:H/A:H triad and is a plausible path to code execution. The one mitigating signal is UI:R: a user must install or update an affected extra-data application from the attacker-controlled repository; it is not a fully autonomous remote exploit. No EPSS score, no CISA KEV entry, and no public POC are present in the supplied data, so there is no evidence of active exploitation - this is a serious latent flaw disclosed responsibly (Red Hat / upstream GHSA), not a confirmed in-the-wild threat. Exploitation status: no public exploit identified at time of analysis. The main gating factor beyond user interaction is that the targeted application must use the extra-data mechanism (xa.extra-data-sources), which narrows the realistic target set from all Flatpak apps to those specific packages.
Exploit ScenarioDerived

An attacker hosts or compromises a Flatpak remote and publishes an extra-data application whose xa.extra-data-sources blob names contain '..' traversal and whose files/extra path is a symlink. When a victim installs or updates that app from the malicious remote - as root for a system install - extract_extra_data() follows the symlink and writes the unsanitized attacker-controlled blob outside the intended directory, landing attacker content at an arbitrary host path (e.g., a systemd unit or profile script) as root. No public POC is referenced in the available data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Arbitrary host filesystem writes are possible in Flatpak through the extra-data fetch path, and on system-wide installs those writes are performed as root, allowing a malicious or compromised remote to plant attacker-controlled files outside the application sandbox. Exploitation is unauthenticated on the attacker's side (PR:N) but requires user interaction (UI:R): the victim must install or update an application whose manifest uses the xa.extra-data-sources mechanism from a malicious or attacker-controlled repository, and full root-level impact additionally depends on a system install rather than a per-user install. Two defects combine - the files/extra directory is resolved through symlink-following path operations, and blob names taken from xa.extra-data-sources are not sanitized against '..' traversal. There is no public exploit identified at time of analysis and no CISA KEV entry; tracking is available through the upstream advisory GHSA-fqx6-vh4p-42cg and Red Hat's CVE/Bugzilla records.

RemediationAI

No vendor-released patch version was specified in the input data, so patch status must be confirmed from the upstream advisory GHSA-fqx6-vh4p-42cg and the Red Hat CVE page https://access.redhat.com/security/cve/CVE-2026-96275 (Bugzilla 2539416); once a fixed Flatpak build is published by your distribution, upgrade the flatpak package immediately, since the vulnerable code is in the client that performs installs and updates. Until a patched build is available, the most effective compensating control is to avoid source-of-truth risk: only install and update Flatpak applications from remotes you control or fully trust, and audit an application's manifest for xa.extra-data-sources before installing it, recognizing that a compromised remote can change what it serves on a later update. Prefer per-user installs (flatpak install --user, or set the user installation as default) so that extra-data writes execute with the invoking user's privileges instead of root - this does not prevent the traversal, but it removes the root-level escalation and confines the arbitrary write to the user's home directory, which remains a significant integrity risk. Remove or disable untrusted remotes (flatpak remote-delete, or flatpak remote-modify --no-enumerate to hide them from enumeration) at the cost of losing access to those applications, and perform installs of untrusted or unfamiliar applications inside a disposable virtual machine or container so that host filesystem writes are contained. Organizations that can enforce it should also consider restricting who may perform system-wide Flatpak installs and monitoring for unexpected file creation outside /var/lib/flatpak during install/update operations. Note that declining to install applications that require extra-data avoids the vulnerable code path entirely, but sacrifices access to applications that depend on proprietary codecs, fonts or drivers.

Affected ProductsAI

The affected component is Flatpak itself, specifically the client-side extra-data handling in extract_extra_data() reachable through the xa.extra-data-sources manifest attribute; applications that do not use extra-data are not directly exploitable through this path. The input data does not include CPE strings or an explicit version range, so the precise set of vulnerable Flatpak releases must be confirmed against the upstream GitHub security advisory GHSA-fqx6-vh4p-42cg, the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-96275, and Red Hat Bugzilla issue 2539416, which together track the packaged Flatpak builds shipped in Red Hat and Fedora-based distributions as well as the upstream project. Impact is magnified on system-wide installations, where the extra-data write runs as root, whereas per-user installations confine the arbitrary write to the invoking user's privileges.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Flatpak is a Linux application sandboxing and distribution framework that installs applications from OSTree-based remotes. Some applications need to fetch data that cannot legally or practically be redistributed (codecs, fonts, proprietary blobs) and declare these in their manifest under the xa.extra-data-sources extended attribute; the Flatpak client downloads those blobs into a staging directory referred to as files/extra and then moves them into place during install or update. CVE-2026-96275 (CWE-22, improper limitation of a pathname to a restricted directory - path traversal) arises from two weaknesses in extract_extra_data(): the destination directory files/extra is resolved using path operations that follow symbolic links rather than resolving to a trusted canonical location, and the blob filenames supplied by the remote via xa.extra-data-sources are not validated to reject '..' components or absolute paths. A malicious or compromised repository can therefore craft blob names that escape the intended staging directory and write to arbitrary paths on the host. Because a system install (as opposed to a per-user install) runs the privileged Flatpak helper, the write is performed with root privileges, breaking the isolation the sandbox is meant to guarantee. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects remote sourcing of the content, no attacker privileges, mandatory user interaction, and high confidentiality, integrity and availability impact confined to the affected host (S:U). No CPE strings or EPSS score were supplied with the source data, so exact affected package versions and distributions must be confirmed against vendor advisories.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI 8.8 HIGH

Malicious remote is network-reachable and unauthenticated (AV:N/PR:N) but needs the user to trigger install/update (UI:R); arbitrary root-owned file write yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob names from xa.extra-data-sources are not sanitized against .. traversal.

Technical POC Analysis

CVE-2026-96275 is a path traversal / link-following write, tracked as CWE-22 (the GitHub advisory body itself lists no CWE; the mapping comes from the CVE record).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Executive ViewAI

Why It Matters

Flatpak, the application sandboxing framework widely deployed on Linux endpoints, carries a high-severity flaw in which installing or updating an application from an untrusted repository can plant attacker-controlled files outside the sandbox - and with root privileges on system-wide installations. Practical exposure is concentrated in environments that let end users add third-party Flatpak remotes and perform system-wide installs, a pattern common on developer and engineering workstations. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should act now to tighten repository trust and install permissions on affected Linux fleets.

Business Impact: High
Compensating Controls

No vendor patch is available; interim mitigations include removing or disabling all untrusted Flatpak remotes, restricting the polkit authorizations that permit repository modification and system-wide installation, and requiring per-user installs (flatpak install --user) so that affected writes cannot occur as root. Deploy file integrity monitoring on /var/lib/flatpak/extra-data and the Flatpak files/extra directories to detect unexpected or anomalous files, and consider SELinux or AppArmor confinement of the flatpak-system-helper process. These controls should remain in place until a fixed Flatpak release is published; track GHSA-fqx6-vh4p-42cg and the Red Hat CVE/Bugzilla entry for patch availability.

Threat Intelligence Overview

EPSS Score
0.4%
Top 73% exploitable
Prevalence
High
Flatpak is the default app distribution framework across many major Linux distributions
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 12 SP5-LTSS Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/409000 REF https://access.redhat.com/errata/RHSA-2026:80497 REF https://access.redhat.com/errata/RHSA-2026:80498 REF https://access.redhat.com/errata/RHSA-2026:80687 REF https://access.redhat.com/security/cve/CVE-2026-96275 REF https://bugzilla.redhat.com/show_bug.cgi?id=2539416 REF https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy