CVE-2026-92162
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
CVE-2026-92162- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-105030
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
EUVD-2026-105030- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
CVE-2026-92162- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
CVE-2026-92162- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
DEBIAN-CVE-2026-92162- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.
- Record
UBUNTU-CVE-2026-92162- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2026-0342 No score
Updated flatpak package fixes security vulnerabilities
Updated flatpak package fixes security vulnerabilities. Please see the links for additional information.
- Record
MGASA-2026-0342- Updated
- 2026-11-02
OSVSUSE-SU-2026:4610-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
- CVE-2026-92162: path traversal via unvalidated
archparameter inDeployAppstream(bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
- CVE-2026-96276: arbitrary write in host context via
flatpak build-init(bsc#1282516). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
- CVE-2026-96283: flatpak-system-helper: cross-user
CancelPullorphans another user's ongoing pull (bsc#1282521). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on
.ld.so(bsc#1282523). - CVE-2026-96808:
revokefssymlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
- Record
SUSE-SU-2026:4610-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4944-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
- CVE-2026-92162: path traversal via unvalidated
archparameter inDeployAppstream(bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
- CVE-2026-96276: arbitrary write in host context via
flatpak build-init(bsc#1282516). - CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on
.ld.so(bsc#1282523). - CVE-2026-96808:
revokefssymlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Changes for flatpak:
- Update to version 1.16.6 (jsc#PED-17048):
- Fix file descriptor leaks affecting Chromium-based browsers.
- Fix installing extra-data without a runtime, including openh264.
- Fix unusable sandbox-expose paths affecting Epiphany.
- Fix installed tests and handling of file descriptor arguments.
- Changes from version 1.16.5:
- Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
- Expand test coverage of flatpak-run features used by the portal.
- Changes from version 1.16.4:
- Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
- Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).
- Changes from version 1.16.3:
- Be selective about mapping font-dirs.xml in flatpak build.
- Changes from version 1.16.2:
- Support reinstalling bundle installations and Intel Xe VA-API.
- Add cancellation support for curl downloads.
- Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.
- Changes from version 1.16.1:
- Allow updating existing apps under parental controls by default.
- Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
- Speed up prune --dry-run and permission-reset.
- Support TLS certificates in /etc/containers/certs.d for OCI.
- Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
- Update documentation and translations.
- Record
SUSE-SU-2026:4944-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:5127-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
- CVE-2026-92162: path traversal via unvalidated
archparameter inDeployAppstream(bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
- CVE-2026-96276: arbitrary write in host context via
flatpak build-init(bsc#1282516). - CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on
.ld.so(bsc#1282523). - CVE-2026-96808:
revokefssymlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Changes for flatpak:
- Update to version 1.16.6 (jsc#PED-17048):
- Fix file descriptor leaks affecting Chromium-based browsers.
- Fix installing extra-data without a runtime, including OpenH264.
- Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
- Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
- Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
- Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
- Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
- Record
SUSE-SU-2026:5127-1- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakDebian:12 |
All versions, plus listed versions 1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1 Show 45 moreShow less1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1 |
None known |
flatpakDebian:13 |
before 1.16.6-1~deb13u3, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 8 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u2 |
1.16.6-1~deb13u3 |
flatpakDebian:14 |
before 1.18.1-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 15 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-1 |
1.18.1-1 |
flatpakMageia:10 From an advisory covering 2 CVEs |
before 1.16.6-1.1.mga10 | 1.16.6-1.1.mga10 |
flatpakSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 9 CVEs |
before 1.4.2-3.15.1 | 1.4.2-3.15.1 |
flatpakSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 9 CVEs |
before 1.4.2-3.15.1 | 1.4.2-3.15.1 |
flatpakSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 9 CVEs |
before 1.16.6-150600.3.12.1 | 1.16.6-150600.3.12.1 |
flatpakSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 9 CVEs |
before 1.16.6-150600.3.12.1 | 1.16.6-150600.3.12.1 |
flatpakSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 9 CVEs |
before 1.16.6-150600.3.12.1 | 1.16.6-150600.3.12.1 |
flatpakSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 11 CVEs |
before 1.16.6-150500.3.21.1 | 1.16.6-150500.3.21.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flatpakSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 11 CVEs |
before 1.16.6-150500.3.21.1 | 1.16.6-150500.3.21.1 |
flatpakSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 11 CVEs |
before 1.16.6-150500.3.21.1 | 1.16.6-150500.3.21.1 |
flatpakSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 11 CVEs |
before 1.16.6-150500.3.21.1 | 1.16.6-150500.3.21.1 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:26.04:LTS |
All versions, plus listed versions 1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xSemizzz/CVE-2026-92162 | 2026-09-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92162 is a high vulnerability (CVSS 7.2) in Flatpak, published August 31, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in flatpak 1.16.6-1~deb13u3.
References
github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
Show 45 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-92162
security-tracker.debian.org/tracker/CVE-2026-92162
advisories.mageia.org/MGASA-2026-0342.html
bugs.mageia.org/show_bug.cgi?id=36137
openwall.com/lists/oss-security/2026/08/11/9
lists.debian.org/debian-security-announce/2026/msg00343.html
lists.fedoraproject.org/archives/list/[email protected]/message/BT77VPU5W2JAF2LEXVLX6Q33HJJAOLTH
suse.com/support/update/announcement/2026/suse-su-20264610-1
bugzilla.suse.com/1280236
ubuntu.com/security/CVE-2026-92162
cve.org/CVERecord?id=CVE-2026-92162
Left out here: 3 versions. The JSON record has them.