Summary
[1.16.0-9.6]
- Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024)
Resolves: RHEL-272185
[1.16.0-9.5]
- Avoid path traversal deletion via deploy export/bin (CVE-2026-97023)
Resolves: RHEL-272031
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | flatpak | 0:1.16.0-9.el10_2.6 |
| Oracle Linux · 10 | flatpak-devel | 0:1.16.0-9.el10_2.6 |
| Oracle Linux · 10 | flatpak-libs | 0:1.16.0-9.el10_2.6 |
| Oracle Linux · 10 | flatpak-selinux | 0:1.16.0-9.el10_2.6 |
| Oracle Linux · 10 | flatpak-session-helper | 0:1.16.0-9.el10_2.6 |
Vulnerabilities 2
-
High 7.1
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-…
-
High 7.1
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlin…