CVE-2026-96275: Flatpak: flatpak: arbitrary write access as root via extra-data extraction

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-10-29
Weakness: CWE-22

Description

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:1.16.0-9.el10_2.4
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.12.9-7.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.12.9-4.el9_8.4
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:1.12.7-5.el9_2.5
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:1.12.9-3.el9_4.5
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:1.12.9-4.el9_6.5

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:1.16.0-9.el10_2.4; Red Hat Enterprise Linux 8 0:1.12.9-7.el8_10; Red Hat Enterprise Linux 9 0:1.12.9-4.el9_8.4; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.12.7-5.el9_2.5; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:1.12.9-3.el9_4.5; Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.12.9-4.el9_6.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-96275 or the next vulnerability affects your stack