CVE-2026-96275
Fixed in a distro release EPSS <1%CVSS 8.8
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | flatpak | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-devel | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-libs | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-selinux | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-session-helper | 1.16.0-9.el10_2.4 |
| AlmaLinux 8 | flatpak | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-devel | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-libs | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-selinux | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-session-helper | 1.12.9-7.el8_10 |
| AlmaLinux 9 | flatpak | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-devel | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-libs | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-selinux | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-session-helper | 1.12.9-4.el9_8.4 |
| Debian 12 | flatpak | no fix |
| Debian 13 | flatpak | 1.16.6-1~deb13u2 |
| Debian 14 | flatpak | 1.18.1-1 |
| Red Hat Enterprise Linux 10.2 | flatpak | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-debugsource | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-devel | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-libs | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-libs-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-selinux | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-session-helper | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-session-helper-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-tests-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 8 | flatpak | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debugsource | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-devel | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-selinux | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-tests-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 9 | flatpak | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-debugsource | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-devel | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-libs | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-libs-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-selinux | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-tests-debuginfo | 0:1.12.9-4.el9_8.4 |
| Rocky Linux 10 | flatpak | 0:1.16.0-9.el10_2.4 |
| Rocky Linux 8 | flatpak | 0:1.12.9-7.el8_10 |
| Rocky Linux 9 | flatpak | 0:1.12.9-4.el9_8.4 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | flatpak | 1.4.2-3.15.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | flatpak | 1.4.2-3.15.1 |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |