CVE-2026-96284

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-27

Last updated on: 2026-09-29

Assigner: redhat-SADP

Description

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-29

Generated

2026-10-18

AI Q&A

2026-09-28

EPSS Evaluated

2026-10-16

NVD

CVE-2026-96284

Affected Vendors & Products

Vendor	Product	Version / Range
flatpak	flatpak	to 1.16.4 (exc)
flatpak	flatpak	1.16.4
flatpak	flatpak	1.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability allows a malicious user to gain read access to files within the flatpak-system-helper context when a system OCI repository is configured. The issue occurs because the OCI code paths in the system helper follow symlinks when importing OCI images controlled by the user.

Detection Guidance

This vulnerability involves symlink following in Flatpak system helper when importing OCI images. Detection requires checking Flatpak configurations and OCI repository settings for improper symlink handling. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this to read sensitive files on your system if they have local access and can control OCI images. This may lead to unauthorized access to confidential data.

Compliance Impact

This vulnerability allows a malicious user to gain read-access to files in the flatpak-system-helper context when a system OCI repository is configured. This could potentially lead to unauthorized access to sensitive data, which may impact compliance with standards like GDPR or HIPAA if such data is exposed.

Mitigation Strategies

Update the flatpak package to the latest version to address the symlink issue in OCI image handling. Review system OCI repository configurations to ensure they are not under user control. Restrict user permissions to prevent unauthorized access to system files.

Hi! I’m here to help you understand CVE-2026-96284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70