{"id":"CVE-2026-96275","revision":"a00339f9aef04ee394366d4f536d93b8","records":[{"revision":"a00339f9aef04ee394366d4f536d93b8","observedAt":"2026-10-26T04:25:11.144+00:00","statement":{"source":"cve-program","id":"CVE-2026-96275","aliases":[],"title":"Flatpak: flatpak: arbitrary write access as root via extra-data extraction","description":"A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.","state":0,"publishedAt":"2026-09-23T15:01:38.344+00:00","modifiedAt":"2026-10-26T02:13:00.533+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.16.0-9.el10_2.4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:10.2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.12.9-7.el8_10\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8::appstream\",\n                        \"cpe:/a:redhat:enterprise_linux:8::crb\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.12.9-4.el9_8.4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9::appstream\",\n                        \"cpe:/a:redhat:enterprise_linux:9::crb\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.12.9-4.el9_6.5\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:rhel_eus:9.6::appstream\",\n                        \"cpe:/a:redhat:rhel_eus:9.6::crb\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://access.redhat.com/errata/RHSA-2026:80497","https://access.redhat.com/errata/RHSA-2026:80498","https://access.redhat.com/errata/RHSA-2026:80687","https://access.redhat.com/errata/RHSA-2026:89733","https://access.redhat.com/security/cve/CVE-2026-96275","https://bugzilla.redhat.com/show_bug.cgi?id=2539416","https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96275","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96275","identifiers":["CVE-2026-96275"]},"retained":false,"historicalAffected":[]}],"coverage":[]}