CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Record
CVE-2026-97024- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-61
- Updated
- 2026-11-04
EUVDEUVD-2026-88624
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Record
EUVD-2026-88624- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
NVD
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Record
CVE-2026-97024- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-61
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-97024
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Record
DEBIAN-CVE-2026-97024- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
OSVRLSA-2026:89849
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89849- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2026:89850
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89850- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVRLSA-2026:89859
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
-
flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
-
flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:89859- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-97024
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Record
UBUNTU-CVE-2026-97024- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVALSA-2026:89849 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89849- Updated
- 2026-11-02
OSVALSA-2026:89850 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89850- Updated
- 2026-11-02
OSVALSA-2026:89859 No score
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
- flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
- flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:89859- Updated
- 2026-11-02
OSVMGASA-2026-0477 No score
Updated flatpak package fixes security vulnerabilities
Arbitrary file deletion in root context via path traversal in deploy directory export/bin. (CVE-2026-97023) Arbitrary write in root context via path traversal in deploy directory files/etc. (CVE-2026-97024) World-readable oci authentication token in system-helper cache path. (CVE-2026-97025) World-writable temporary child repositories in system-helper cache path. (CVE-2026-97026) Denial of service via unsanitized keys in exported desktop entry / d-bus service files. (CVE-2026-97027) Sandboxed app can signal unsandboxed processes in the same process group. (CVE-2026-97029)
- Record
MGASA-2026-0477- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11918-1 No score
flatpak-1.18.4-1.1 on GA media
These are all security issues fixed in the flatpak-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11918-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-develAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-libsAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-selinuxAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpak-session-helperAlmaLinux:10 From an advisory covering 2 CVEs |
before 1.16.0-9.el10_2.6 | 1.16.0-9.el10_2.6 |
flatpakAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpak-develAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpak-session-helperAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.12.9-4.el9_8.6 | 1.12.9-4.el9_8.6 |
flatpakAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-develAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flatpak-libsAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-selinuxAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpak-session-helperAlmaLinux:8 From an advisory covering 2 CVEs |
before 1.12.9-9.el8_10 | 1.12.9-9.el8_10 |
flatpakDebian:12 |
All versions, plus listed versions 1.14.10-11.14.10-1~deb12u11.14.10-1~deb12u21.14.4-11.14.4-1+deb12u1 Show 45 moreShow less1.14.4-1+deb12u1~bpo11+11.14.4-21.14.5-11.14.6-11.14.6-1~deb13u11.14.8-11.14.8-1~deb12u11.15.0-11.15.0-21.15.1-11.15.10-11.15.12-11.15.2-11.15.3-11.15.4-11.15.6-11.15.7-11.15.8-11.15.9-11.15.91-11.16.0-11.16.0-21.16.0-2~bpo12+11.16.1-11.16.1-1~bpo12+11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u11.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-1 |
None known |
flatpakDebian:13 |
before 1.16.6-1~deb13u3, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 8 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u2 |
1.16.6-1~deb13u3 |
flatpakDebian:14 |
before 1.18.4-1, plus listed versions 1.16.1-11.16.1-21.16.1-31.16.2-11.16.2-1~deb13u1 Show 18 moreShow less1.16.3-11.16.3-1~deb13u11.16.4-11.16.4-21.16.5-11.16.6-11.16.6-1~deb13u11.16.6-1~deb13u1~bpo12+11.16.6-1~deb13u21.16.6-1~deb13u31.17.2-11.17.3-11.17.3-21.17.6-11.18.0-11.18.1-11.18.2-11.18.3-1 |
1.18.4-1 |
flatpakMageia:10 From an advisory covering 6 CVEs |
before 1.16.6-1.2.mga10 | 1.16.6-1.2.mga10 |
flatpakRocky Linux:10 From an advisory covering 2 CVEs |
before 0:1.16.0-9.el10_2.6 | 0:1.16.0-9.el10_2.6 |
flatpakRocky Linux:9 From an advisory covering 2 CVEs |
before 0:1.12.9-4.el9_8.6 | 0:1.12.9-4.el9_8.6 |
flatpakRocky Linux:8 From an advisory covering 2 CVEs |
before 0:1.12.9-9.el8_10 | 0:1.12.9-9.el8_10 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.14.4-21.14.5-11.14.5-1build11.14.5-1build41.14.5-1build5 Show 4 moreShow less1.14.5-1build61.14.6-11.14.6-1ubuntu0.11.14.6-1ubuntu0.1+esm1 |
None known |
flatpakUbuntu:26.10 |
All versions, plus listed versions 1.16.6-11.18.0-11.18.1-11.18.2-11.18.4-1 |
None known |
flatpakUbuntu:26.04:LTS |
All versions, plus listed versions 1.16.1-2ubuntu11.16.1-3ubuntu11.16.2-11.16.3-11.16.3-1build11.16.4-11.16.4-21.16.6-1 |
None known |
flatpakopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.18.4-1.1 | 1.18.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | NVD, OSV | |
| products, references | EUVD, NVD | |
| references | CVE List | |
| products, references | EUVD | |
| references | CVE List, NVD | |
| products, references | EUVD | |
| facts, products, references | CVE List | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97024 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in flatpak 1.16.6-1~deb13u3.
References
access.redhat.com/errata/RHSA-2026:89849
Show 31 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2542625
github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
errata.almalinux.org/10/ALSA-2026-89849.html
security-tracker.debian.org/tracker/CVE-2026-97024
advisories.mageia.org/MGASA-2026-0477.html
bugs.mageia.org/show_bug.cgi?id=36401
openwall.com/lists/oss-security/2026/09/28/6
lists.debian.org/debian-security-announce/2026/msg00437.html
errata.rockylinux.org/RLSA-2026:89849
ubuntu.com/security/CVE-2026-97024
cve.org/CVERecord?id=CVE-2026-97024
suse.com/security/cve/CVE-2026-97023
Left out here: 3 versions. The JSON record has them.