Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
Historical advisory recorded 26 Oct 2026 11:35:56 UTC. Read the latest advisory.
cve-program · CVE-2026-97023
PublishedA path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-97023 · CVE overview and exploitation status
cve-program · CVE-2026-97023
- https://access.redhat.com/errata/RHSA-2026:89849
- https://access.redhat.com/errata/RHSA-2026:89850
- https://access.redhat.com/errata/RHSA-2026:89859
- https://access.redhat.com/security/cve/CVE-2026-97023
- https://bugzilla.redhat.com/show_bug.cgi?id=2542606
- https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.