Flatpak System Helper OCI Image Symlink Path Traversal

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: redhat-SADP

Description

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-27

Generated

2026-09-28

AI Q&A

2026-09-28

EPSS Evaluated

N/A

NVD

CVE-2026-96284

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability allows a malicious user to gain read access to files within the flatpak-system-helper context when a system OCI repository is configured. The issue occurs because the OCI code paths in the system helper follow symlinks when importing OCI images controlled by the user.

Impact Analysis

An attacker could exploit this to read sensitive files on your system if they have local access and can control OCI images. This may lead to unauthorized access to confidential data.

Mitigation Strategies

Update the flatpak package to the latest version to address the symlink issue in OCI image handling. Review system OCI repository configurations to ensure they are not under user control. Restrict user permissions to prevent unauthorized access to system files.

Hi! I’m here to help you understand CVE-2026-96284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70