Summary
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 41
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | flatpak | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debugsource | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debugsource | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debugsource | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debugsource | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-debugsource | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-devel | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-devel | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-devel | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-devel | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-devel | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-libs-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-selinux | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper-debuginfo | 0:1.12.9-6.el9_9.5 |
| Rocky Linux · 9 | flatpak-session-helper-debuginfo | 0:1.12.9-6.el9_9.5 |
Vulnerabilities 6
-
High 8.8
Flatpak: flatpak: arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…
-
High 7.5
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…
-
High 7.4
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…
-
High 7.4
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…
-
High 7.1
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-…
-
High 7.1
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlin…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532613
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539416
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539419
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539569
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542606
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542625
-
advisory
https://access.redhat.com/errata/RHSA-2026:98490