Red Hat Security Advisory: flatpak security update

Fixed packages 10

Vulnerabilities 6

• High 8.8
  CVE-2026-96275

  Flatpak: flatpak: arbitrary write access as root via extra-data extraction

  A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Sep 23, 2026
• High 7.5
  CVE-2026-96280

  Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

  The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Sep 27, 2026
• High 7.4
  CVE-2026-90616

  In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Sep 12, 2026
• High 7.4
  CVE-2026-96808

  In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Sep 23, 2026
• High 7.1
  CVE-2026-97023

  Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

  A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Sep 28, 2026
• High 7.1
  CVE-2026-97024

  Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

  A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlin…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Sep 29, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539416
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539569
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542625
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98595.json
• report
  https://access.redhat.com/security/cve/CVE-2026-90616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90616
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90616
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
• article
  https://www.openwall.com/lists/oss-security/2026/08/11/9
• report
  https://access.redhat.com/security/cve/CVE-2026-96275
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96275
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96275
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
• report
  https://access.redhat.com/security/cve/CVE-2026-96280
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96280
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
• report
  https://access.redhat.com/security/cve/CVE-2026-96808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96808
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96808
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp
• report
  https://access.redhat.com/security/cve/CVE-2026-97023
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542606
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-97023
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-97023
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
• report
  https://access.redhat.com/security/cve/CVE-2026-97024
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-97024
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-97024
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf