CVE-2026-96275
Received Received - Intake

Malicious Flatpak Repository Filesystem Write Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96275
EUVD
EUVD-2026-85342

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
flatpak flatpak 1.18.0
flatpak flatpak 1.18.1
flatpak flatpak 1.16.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96275 is a vulnerability in Flatpak versions 1.18.0 and earlier that allows arbitrary write access as root via extra-data extraction. A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem during system installs, where operations run with root permissions. The issue stems from two flaws in the extract_extra_data function: it follows symlinks when resolving paths and fails to sanitize directory traversal sequences (..) in blob names from xa.extra-data-sources.

Detection Guidance

Check Flatpak version with 'flatpak --version'. If it is 1.18.0 or earlier, the system is vulnerable. Inspect Flatpak repositories for untrusted sources or suspicious metadata. Look for unexpected files in system directories like /usr, /etc, or /tmp that may indicate exploitation.

Impact Analysis

This vulnerability allows attackers to write malicious files to any location on your system with root privileges if you install or update a Flatpak from an untrusted source. This could lead to system compromise, data theft, or installation of persistent malware. Attackers could overwrite critical system files, modify configurations, or gain full control of the affected system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data, system compromise, or data breaches. Organizations may face legal penalties, reputational damage, and loss of customer trust if such an attack occurs due to inadequate patch management or untrusted software sources.

Mitigation Strategies

Upgrade Flatpak to version 1.18.1 or later. Avoid installing Flatpak extensions from untrusted sources. If upgrading is not possible, remove Flatpak temporarily or restrict its use to trusted repositories until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart