CVE-2026-97023
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
- Record
CVE-2026-97023- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-61
- Updated
- 2026-11-04
EUVDEUVD-2026-88442
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
- Record
EUVD-2026-88442- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
NVD
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
- Record
CVE-2026-97023- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-61
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
- Record
DEBIAN-CVE-2026-97023- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
OSVRLSA-2026:89849
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89849- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2026:89850
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89850- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVRLSA-2026:89859
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89859- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
- Record
UBUNTU-CVE-2026-97023- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVALSA-2026:89849 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89849- Updated
- 2026-11-02
OSVALSA-2026:89850 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89850- Updated
- 2026-11-02
OSVALSA-2026:89859 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89859- Updated
- 2026-11-02
OSVCLSA-2026-1792769619 No score
flatpak: Fix of CVE-2026-97023
- CVE-2026-97023: fix arbitrary file deletion during deploy, where a malicious ostree commit with "export" as a symlink made the path-based export/bin cleanup delete files at the symlink target
- Record
CLSA-2026-1792769619- Updated
- 2026-11-02
OSVCLSA-2026-1792769794 No score
flatpak: Fix of CVE-2026-97023
- CVE-2026-97023: fix arbitrary file deletion during deploy, where a malicious ostree commit with "export" as a symlink made the path-based export/bin cleanup delete files at the symlink target
- Record
CLSA-2026-1792769794- Updated
- 2026-11-02
OSVMGASA-2026-0477 No score
Updated flatpak package fixes security vulnerabilities
Arbitrary file deletion in root context via path traversal in deploy directory export/bin. (CVE-2026-97023) Arbitrary write in root context via path traversal in deploy directory files/etc. (CVE-2026-97024) World-readable oci authentication token in system-helper cache path. (CVE-2026-97025) World-writable temporary child repositories in system-helper cache path. (CVE-2026-97026) Denial of service via unsanitized keys in exported desktop entry / d-bus service files. (CVE-2026-97027) Sandboxed app can signal unsandboxed processes in the same process group. (CVE-2026-97029)
- Record
MGASA-2026-0477- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11918-1 No score
flatpak-1.18.4-1.1 on GA media
These are all security issues fixed in the flatpak-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11918-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-develAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-libsAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-selinuxAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-session-helperAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpakAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpak-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpak-session-helperAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpakAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flatpak-libsAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-selinuxAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-session-helperAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpakTuxCare:OracleLinux:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpak-builderTuxCare:OracleLinux:7 |
before 1.0.0-13.0.1.el7_9.tuxcare.els2 | 1.0.0-13.0.1.el7_9.tuxcare.els2 |
flatpak-develTuxCare:OracleLinux:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpak-libsTuxCare:OracleLinux:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpakTuxCare:RHEL:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpak-builderTuxCare:RHEL:7 |
before 1.0.0-13.0.1.el7_9.tuxcare.els2 | 1.0.0-13.0.1.el7_9.tuxcare.els2 |
flatpak-develTuxCare:RHEL:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpak-libsTuxCare:RHEL:7 |
before 1.0.9-13.0.1.el7_9.tuxcare.els2 | 1.0.9-13.0.1.el7_9.tuxcare.els2 |
flatpakDebian:12 |
All versions, plus listed versions 1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1 Show 45 moreShow less1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1 |
None known |
flatpakDebian:13 |
before 1.16.6-1~deb13u3, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 8 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u2 |
1.16.6-1~deb13u3 |
flatpakDebian:14 |
before 1.18.4-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 18 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-11.18.2-11.18.3-1 |
1.18.4-1 |
flatpakMageia:10 From an advisory covering 6 CVEs |
before 1.16.6-1.2.mga10 | 1.16.6-1.2.mga10 |
flatpakRocky Linux:10 From an advisory covering 2 CVEs |
before 0:1.16.0-9.el10_2.6 | 0:1.16.0-9.el10_2.6 |
flatpakRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.12.9-4.el9_8.6 | 0:1.12.9-4.el9_8.6 |
flatpakRocky Linux:8 From an advisory covering 2 CVEs |
before 0:1.12.9-9.el8_10 | 0:1.12.9-9.el8_10 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:26.10 |
All versions, plus listed versions 1.16.6-11.18.0-11.18.1-11.18.2-11.18.4-1 |
None known |
flatpakUbuntu:26.04:LTS |
All versions, plus listed versions 1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1 |
None known |
flatpakopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.18.4-1.1 | 1.18.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | NVD, OSV | |
| products, references | EUVD, NVD | |
| references | CVE List | |
| products, references | EUVD | |
| references | CVE List, NVD | |
| products, references | EUVD | |
| facts, products, references | CVE List | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97023 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published September 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in flatpak 1.0.9-13.0.1.el7_9.tuxcare.els2.
References
access.redhat.com/errata/RHSA-2026:89849
Show 34 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2542606
github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
errata.almalinux.org/10/ALSA-2026-89849.html
errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792769619.html
nvd.nist.gov/vuln/detail/CVE-2026-97023
security-tracker.debian.org/tracker/CVE-2026-97023
advisories.mageia.org/MGASA-2026-0477.html
bugs.mageia.org/show_bug.cgi?id=36401
openwall.com/lists/oss-security/2026/09/28/6
lists.debian.org/debian-security-announce/2026/msg00437.html
errata.rockylinux.org/RLSA-2026:89849
ubuntu.com/security/CVE-2026-97023
cve.org/CVERecord?id=CVE-2026-97023
suse.com/security/cve/CVE-2026-97023
Left out here: 3 versions. The JSON record has them.