CVE-2026-76925
Flatpak: flatpak: toctou race condition allows symlink redirection
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Flatpak: flatpak: toctou race condition allows symlink redirection
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
- Record
CVE-2026-76925- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-367
- Updated
- 2026-11-06
EUVDEUVD-2026-71774
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
- Record
EUVD-2026-71774- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-639f-3fwc-hmpx
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the...
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
- Record
GHSA-639f-3fwc-hmpx- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-367
- Updated
- 2026-11-02
NVD
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
- Record
CVE-2026-76925- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-367
- Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-76925
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
- Record
UBUNTU-CVE-2026-76925- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:26.10 |
All versions, plus listed versions 1.16.6-11.18.0-11.18.1-11.18.2-11.18.4-1 |
None known |
flatpakUbuntu:26.04:LTS |
All versions, plus listed versions 1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-76925 is a medium vulnerability (CVSS 5.8) in Red Hat Enterprise Linux 10, published September 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.