CVE-2026-96276
Fixed in a distro release EPSS <1%CVSS 6.5
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | flatpak | no fix |
| Debian 13 | flatpak | 1.16.6-1~deb13u2 |
| Debian 14 | flatpak | 1.18.1-1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | flatpak | 1.4.2-3.15.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | flatpak | 1.4.2-3.15.1 |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |