Every CVE Search/ Get API key

CVE-2026-96282

Flatpak: flatpak: extension metadata path traversal file existence oracle

3.1 LowFix available

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.24%Down 0.1 points since Sep 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Record
CVE-2026-96282
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-59
Updated
2026-11-06
EUVDEUVD-2026-88044 3.1

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Record
EUVD-2026-88044
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-06
NVD 3.1

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Record
CVE-2026-96282
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-59
Updated
2026-11-06
OSVDEBIAN-CVE-2026-96282 3.1

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Record
DEBIAN-CVE-2026-96282
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-07
OSVOESA-2026-4308 3.3

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)

Record
OESA-2026-4308
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4309 3.3

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)

Record
OESA-2026-4309
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-4310 3.3

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)

Record
OESA-2026-4310
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4311 3.3

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)

Record
OESA-2026-4311
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-96282 3.1

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Record
UBUNTU-CVE-2026-96282
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVSUSE-SU-2026:4610-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96283: flatpak-system-helper: cross-user CancelPull orphans another user's ongoing pull (bsc#1282521).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Record
SUSE-SU-2026:4610-1
Updated
2026-11-02
OSVSUSE-SU-2026:4944-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including openh264.
  • Fix unusable sandbox-expose paths affecting Epiphany.
  • Fix installed tests and handling of file descriptor arguments.
  • Changes from version 1.16.5:
  • Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
  • Expand test coverage of flatpak-run features used by the portal.
  • Changes from version 1.16.4:
  • Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
  • Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).
  • Changes from version 1.16.3:
  • Be selective about mapping font-dirs.xml in flatpak build.
  • Changes from version 1.16.2:
  • Support reinstalling bundle installations and Intel Xe VA-API.
  • Add cancellation support for curl downloads.
  • Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.
  • Changes from version 1.16.1:
  • Allow updating existing apps under parental controls by default.
  • Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
  • Speed up prune --dry-run and permission-reset.
  • Support TLS certificates in /etc/containers/certs.d for OCI.
  • Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
  • Update documentation and translations.
Record
SUSE-SU-2026:4944-1
Updated
2026-11-02
OSVSUSE-SU-2026:5127-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
  • CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
  • CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
  • CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
  • CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
  • CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
  • CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
  • CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
  • CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
  • CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
  • CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

  • Update to version 1.16.6 (jsc#PED-17048):
  • Fix file descriptor leaks affecting Chromium-based browsers.
  • Fix installing extra-data without a runtime, including OpenH264.
  • Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
  • Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.
  • Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
  • Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
  • Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.
Record
SUSE-SU-2026:5127-1
Updated
2026-11-07

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Debian:12
 All versions, plus listed versions
1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1
Show 45 moreShow less
1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1
 None known
flatpak
Debian:13
 before 1.16.6-1~deb13u2, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 7 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+1
1.16.6-1~deb13u2
flatpak
Debian:14
 before 1.18.1-1, plus listed versions
1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1
Show 15 moreShow less
1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-1
1.18.1-1
flatpak
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.10.2-15.oe2403sp1
1.10.2-15.oe2403sp1
flatpak
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.10.2-15.oe2403sp3
1.10.2-15.oe2403sp3
flatpak
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.10.2-15.oe2403sp4
1.10.2-15.oe2403sp4
flatpak
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.10.2-15.oe2203sp4
1.10.2-15.oe2203sp4
flatpak
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.4.2-3.15.1
1.4.2-3.15.1
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
flatpak
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 9 CVEs
 before 1.16.6-150600.3.12.1
1.16.6-150600.3.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 1.16.6-150500.3.21.1
1.16.6-150500.3.21.1
flatpak
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 16 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1
 None known
flatpak
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1
Show 6 moreShow less
1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1
 None known
flatpak
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1
Show 5 moreShow less
1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5
Show 4 moreShow less
1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1
 None known
flatpak
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96282 is a low vulnerability (CVSS 3.1) in Red Hat Enterprise Linux 10, published September 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in flatpak 1.16.6-1~deb13u2.

References

Show 33 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open