{"id":"CVE-2026-96275","state":"PUBLISHED","title":"Flatpak: flatpak: arbitrary write access as root via extra-data extraction","description":"A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.","publishedAt":"2026-09-23T15:01:38.344Z","updatedAt":"2026-10-29T19:38:38.492Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Red Hat Enterprise Linux 7"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.16.0-9.el10_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-7.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-4.el9_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.7-5.el9_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-3.el9_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-4.el9_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/a:redhat:rhel_eus:9.6::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"flatpak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":["https://access.redhat.com/errata/RHSA-2026:80497","https://access.redhat.com/errata/RHSA-2026:80498","https://access.redhat.com/errata/RHSA-2026:80687","https://access.redhat.com/errata/RHSA-2026:89733","https://access.redhat.com/errata/RHSA-2026:90364","https://access.redhat.com/errata/RHSA-2026:92369","https://access.redhat.com/security/cve/CVE-2026-96275","https://bugzilla.redhat.com/show_bug.cgi?id=2539416","https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:14:45.636Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/96xxx/CVE-2026-96275.json","commit":"f3256dbff015d5005201759d42bdccb6679ce6d3","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-96275","state":"PUBLISHED","datePublished":"2026-09-23T15:01:38.344Z","dateUpdated":"2026-10-29T19:38:38.492Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-09-22T20:42:17.038Z"},"containers":{"cna":{"title":"Flatpak: flatpak: arbitrary write access as root via extra-data extraction","descriptions":[{"lang":"en","value":"A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.16.0-9.el10_2.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-7.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-4.el9_8.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.7-5.el9_2.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-3.el9_4.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"flatpak","defaultStatus":"affected","versions":[{"version":"0:1.12.9-4.el9_6.5","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/a:redhat:rhel_eus:9.6::crb"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"flatpak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:80497","name":"RHSA-2026:80497","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80498","name":"RHSA-2026:80498","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80687","name":"RHSA-2026:80687","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89733","name":"RHSA-2026:89733","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90364","name":"RHSA-2026:90364","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92369","name":"RHSA-2026:92369","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96275","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539416","name":"RHBZ#2539416","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-29T19:38:38.492Z"},"datePublic":"2026-08-11T00:00:00.000Z","x_redhatCweChain":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","workarounds":[{"lang":"en","value":"Avoid installing Flatpak extensions from non-trusted sources."}],"timeline":[{"lang":"en","time":"2026-08-11T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-11T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Upstream acknowledges Sebastian Wick as the original reporter."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-25T18:09:09.886853Z","id":"CVE-2026-96275","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-25T18:09:21.071Z"}}]}}}