CVE-2026-96808
Received Received - Intake

Symlink Traversal in Flatpak Before 1.18.1

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: MITRE

Description
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96808
EUVD
EUVD-2026-85424

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flatpak flatpak to 1.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96808 is a symlink path traversal vulnerability in Flatpak versions 1.18.0 and earlier. It affects the revokefs writer component used by the flatpak-system-helper to receive repository data from unprivileged users. The flaw allows a local attacker to bypass path validation by creating a symlink in one revokefs session that points into another session's directory, enabling tampering with validated files after import. This can lead to modification of ostree commit objects in the system repository after signature verification, resulting in root-controlled file writes to attacker-chosen paths and local root privilege escalation.

The issue occurs because revokefs rejects literal '..' components but does not prevent symlink-based traversal. An attacker with a local session can exploit this by retaining a file descriptor through a symlink, allowing post-validation file modifications.

Detection Guidance

Check your Flatpak version with 'flatpak --version'. If it is 1.18.0 or earlier, your system is vulnerable. Review logs for revokefs operations in /var/log or journalctl for unusual file access patterns.

Impact Analysis

If you use Flatpak versions 1.18.0 or earlier on a system with default Polkit policies, an attacker with local access could escalate privileges to root. This could allow them to install malicious software, access sensitive data, or perform unauthorized system changes. Systems with restricted Polkit policies requiring admin authentication for all operations are not affected.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially compromising system integrity and data confidentiality. For GDPR, it may violate requirements for protecting personal data due to unauthorized access. For HIPAA, it could risk unauthorized access to protected health information. Compliance may be impacted if the system is used in environments requiring strict access controls and auditability.

Mitigation Strategies

Update Flatpak to version 1.18.1 or later. If using an LTS distribution, apply the backported fix from the flatpak-1.16.x branch. Restrict Polkit policies to require admin authentication for runtime updates if not already enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart