{"id":"CVE-2026-92162","aliases":["DEBIAN-CVE-2026-92162","EUVD-2026-105030","GHSA-v2gw-v9h5-9q4x","MGASA-2026-0342","SUSE-SU-2026:4610-1","SUSE-SU-2026:4944-1","SUSE-SU-2026:5127-1","UBUNTU-CVE-2026-92162"],"status":"published","title":"Flatpak vulnerable to path traversal via unvalidated \"arch\" parameter in DeployAppstream","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00233,"percentile":0.14263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-31T16:22:02Z","modified":"2026-11-07T11:30:04Z","exploits":[{"source":"pocgithub","id":"0xSemizzz/CVE-2026-92162","title":"0xSemizzz/CVE-2026-92162","date":"2026-09-03","url":"https://github.com/0xSemizzz/CVE-2026-92162"}],"fixes":[{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.18.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-1~deb12u2","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1","1.15.0-1","1.15.0-2","1.15.1-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.3-1","1.15.4-1","1.15.6-1","1.15.7-1","1.15.8-1","1.15.9-1","1.15.91-1","1.16.0-1","1.16.0-2","1.16.0-2~bpo12+1","1.16.1-1","1.16.1-1~bpo12+1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1","1.18.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u3"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-2ubuntu1","1.16.1-3ubuntu1","1.16.2-1","1.16.3-1","1.16.3-1build1","1.16.4-1","1.16.4-2","1.16.6-1"]}],"products":[{"vendor":"flatpak","product":"flatpak"}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/flatpak/flatpak/pull/6768","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/01773f84021dd090b2426f79675f94f2564f9279","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/19456b916842b079af833a86b9ab89c5db154b92","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/aeb369a2723506fabc1f701ef7a0dc6c97c4b983","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92162.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92162","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-92162","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0342.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36137","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/11/9","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00343.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT77VPU5W2JAF2LEXVLX6Q33HJJAOLTH/","tags":["web"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264610-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280236","tags":["report"]},{"url":"https://bugzilla.suse.com/1282514","tags":["report"]},{"url":"https://bugzilla.suse.com/1282515","tags":["report"]},{"url":"https://bugzilla.suse.com/1282516","tags":["report"]},{"url":"https://bugzilla.suse.com/1282519","tags":["report"]},{"url":"https://bugzilla.suse.com/1282520","tags":["report"]},{"url":"https://bugzilla.suse.com/1282521","tags":["report"]},{"url":"https://bugzilla.suse.com/1282523","tags":["report"]},{"url":"https://bugzilla.suse.com/1282524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282518","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96280","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261769","tags":["report"]},{"url":"https://bugzilla.suse.com/1261770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34079","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-92162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92162","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-92162","title":"Flatpak vulnerable to path traversal via unvalidated \"arch\" parameter in DeployAppstream","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T14:39:50.538Z","modified":"2026-10-20T15:32:18.64Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-105030","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T14:39:50Z","modified":"2026-10-20T15:32:18Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:43.975979Z"}],"nvd":[{"id":"CVE-2026-92162","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T15:17:36.3Z","modified":"2026-10-20T20:06:37.15Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-92162","title":"Flatpak vulnerable to path traversal via unvalidated \"arch\" parameter in DeployAppstream","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T14:39:50.538Z","modified":"2026-11-07T11:41:57.743555307Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-07T12:16:09.040155Z"},{"id":"DEBIAN-CVE-2026-92162","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T15:17:36.3Z","modified":"2026-10-23T18:04:44.775325615Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"UBUNTU-CVE-2026-92162","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.","status":"published","published":"2026-10-20T15:17:00Z","modified":"2026-10-28T20:17:25.459800817Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"MGASA-2026-0342","title":"Updated flatpak package fixes security vulnerabilities","description":"Updated flatpak package fixes security vulnerabilities. Please see the\nlinks for additional information.\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-09-23T02:00:06.842112748Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"SUSE-SU-2026:4610-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96283: flatpak-system-helper: cross-user `CancelPull` orphans another user's ongoing pull (bsc#1282521).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n","status":"published","published":"2026-10-09T15:55:00Z","modified":"2026-10-10T09:30:06.446561391Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4944-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including openh264.\n + Fix unusable sandbox-expose paths affecting Epiphany.\n + Fix installed tests and handling of file descriptor arguments.\n- Changes from version 1.16.5:\n + Fix regressions from the sandbox escape security fix affecting\n browsers, browser-based apps and Steam.\n + Expand test coverage of flatpak-run features used by the portal.\n- Changes from version 1.16.4:\n + Prevent arbitrary file reads in the system-helper context\n (GHSA-2fxp-43j9-pwvc).\n + Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).\n- Changes from version 1.16.3:\n + Be selective about mapping font-dirs.xml in flatpak build.\n- Changes from version 1.16.2:\n + Support reinstalling bundle installations and Intel Xe VA-API.\n + Add cancellation support for curl downloads.\n + Fix font configuration, mask and pin configuration reloads,\n unintended home directory access, flatpak kill, OCI support,\n memory leaks and crashes.\n- Changes from version 1.16.1:\n + Allow updating existing apps under parental controls by default.\n + Use instance IDs for systemd scopes and include /dev/udmabuf\n with --device=dri.\n + Speed up prune --dry-run and permission-reset.\n + Support TLS certificates in /etc/containers/certs.d for OCI.\n + Fix portal crashes, sandbox environment handling, accessibility\n bus discovery, error reporting and shell completion.\n + Update documentation and translations.\n","status":"published","published":"2026-10-29T16:29:47Z","modified":"2026-10-31T18:00:03.939717669Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5127-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including OpenH264.\n + Ignore unusable sandbox-expose paths for portal sub-sandboxes,\n fixing Epiphany regressions.\n + Fix installed tests and handling of standard file descriptors\n passed as invalid flatpak run arguments.\n- Switch from Autotools to Meson, preserving system bubblewrap,\n xdg-dbus-proxy, curl and distribution-specific installation paths.\n- Require bubblewrap \u003e= 0.10.0 and GPGME \u003e= 1.8.0; add Meson,\n gettext, gtk-doc and polkit-agent build dependencies and drop\n obsolete intltool and libelf build dependencies.\n- Generate the system-user pre-script from the Meson build directory\n and package the tmpfiles configuration and renamed manual pages.\n","status":"published","published":"2026-11-06T08:27:38Z","modified":"2026-11-07T11:30:04.13853174Z","updated_at":"2026-11-07T11:45:54.882758Z"}]}}