{"id":"CVE-2026-96284","aliases":["DEBIAN-CVE-2026-96284","EUVD-2026-88046","UBUNTU-CVE-2026-96284"],"status":"published","title":"Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0012,"percentile":0.01828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-09-27T22:04:48Z","modified":"2026-11-06T20:01:20Z","fixes":[{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.14.10-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.16.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1~deb12u2"}]}],"versions":["1.14.10-1~deb12u1","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96284","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539423","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96284","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-96284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96284","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-96284","title":"Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","status":"published","published":"2026-09-27T22:04:48.577Z","modified":"2026-11-06T20:01:20.516Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T21:31:08.131839Z"}],"euvd":[{"id":"EUVD-2026-88046","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","status":"published","published":"2026-09-27T22:04:48Z","modified":"2026-11-06T20:01:20Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-06T21:07:00.111123Z"}],"nvd":[{"id":"CVE-2026-96284","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","status":"published","published":"2026-09-27T23:17:01.13Z","modified":"2026-11-06T20:17:30.93Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T22:02:13.943945Z"}],"osv":[{"id":"DEBIAN-CVE-2026-96284","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","status":"published","published":"2026-09-27T23:17:01.13Z","modified":"2026-11-07T09:47:29.580342771Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2026-96284","description":"A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.","status":"published","published":"2026-09-27T23:17:00Z","modified":"2026-10-01T00:22:42.726489528Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:57:44.071534Z"}]}}