CVE-2026-96279

Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

State: Published
Severity: 6.5 Medium
Published: Sep 27, 2026
Updated: Sep 28, 2026
Reserved: Sep 22, 2026

Description

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-96279vdb-entry
RHBZ#2539417issue-tracking
https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.