Summary
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | flatpak | 1.12.9-9.el8_10 |
| AlmaLinux · 8 | flatpak-devel | 1.12.9-9.el8_10 |
| AlmaLinux · 8 | flatpak-libs | 1.12.9-9.el8_10 |
| AlmaLinux · 8 | flatpak-selinux | 1.12.9-9.el8_10 |
| AlmaLinux · 8 | flatpak-session-helper | 1.12.9-9.el8_10 |
Vulnerabilities 2
-
High 7.1
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-…
-
High 7.1
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlin…