{"id":"CVE-2026-97023","aliases":["ALSA-2026:89849","ALSA-2026:89850","ALSA-2026:89859","CLSA-2026-1792769619","CLSA-2026-1792769794","DEBIAN-CVE-2026-97023","EUVD-2026-88442","MGASA-2026-0477","RLSA-2026:89849","RLSA-2026:89850","RLSA-2026:89859","UBUNTU-CVE-2026-97023","openSUSE-SU-2026:11918-1"],"status":"published","title":"Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00461,"percentile":0.40181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-09-28T18:53:28Z","modified":"2026-11-05T09:47:32Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:7","package":"flatpak","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-builder","fixed_in":["1.0.0-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-devel","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-libs","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"flatpak","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"flatpak-builder","fixed_in":["1.0.0-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"flatpak-devel","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"flatpak-libs","fixed_in":["1.0.9-13.0.1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.18.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.0.1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-1~deb12u2","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1","1.15.0-1","1.15.0-2","1.15.1-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.3-1","1.15.4-1","1.15.6-1","1.15.7-1","1.15.8-1","1.15.9-1","1.15.91-1","1.16.0-1","1.16.0-2","1.16.0-2~bpo12+1","1.16.1-1","1.16.1-1~bpo12+1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1","1.18.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u3"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1.2.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-9.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-2ubuntu1","1.16.1-3ubuntu1","1.16.2-1","1.16.3-1","1.16.3-1build1","1.16.4-1","1.16.4-2","1.16.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:89849","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89850","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89859","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95061","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95062","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95063","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97023","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542606","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95064"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97024","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542625","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-89849.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-89850.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-89859.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792769619.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97023","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792769794.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97023","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36401","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/6","tags":["web"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00437.html","tags":["web"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89849","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542625","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89850","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89859","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97023","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97029","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97023","title":"Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","status":"published","published":"2026-09-28T18:53:28.6Z","modified":"2026-11-04T12:17:46.912Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-04T13:30:21.055138Z"}],"euvd":[{"id":"EUVD-2026-88442","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","status":"published","published":"2026-09-28T18:53:28Z","modified":"2026-11-05T00:15:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-05T01:48:37.947628Z"}],"nvd":[{"id":"CVE-2026-97023","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","status":"published","published":"2026-09-28T19:16:50.71Z","modified":"2026-11-05T01:17:25.41Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-05T06:56:40.786164Z"}],"osv":[{"id":"DEBIAN-CVE-2026-97023","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","status":"published","published":"2026-09-28T19:16:50.71Z","modified":"2026-11-05T09:47:32.881420543Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RLSA-2026:89849","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n\n* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:08:55.409043Z","modified":"2026-10-27T12:30:03.128566246Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89850","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n\n* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:04:29.081572Z","modified":"2026-10-27T12:30:04.738517187Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89859","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n\n* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:01:24.400471Z","modified":"2026-10-27T12:30:02.554181277Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-97023","description":"A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.","status":"published","published":"2026-09-28T19:16:00Z","modified":"2026-10-17T13:01:20.193541009Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"ALSA-2026:89849","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n  * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:31:03.950003322Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89850","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n  * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:08.031367038Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89859","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)\n  * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:02:25.417339249Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"CLSA-2026-1792769619","title":"flatpak: Fix of CVE-2026-97023","description":"- CVE-2026-97023: fix arbitrary file deletion during deploy, where a malicious\n  ostree commit with \"export\" as a symlink made the path-based export/bin\n  cleanup delete files at the symlink target","status":"published","published":"2026-10-23T15:33:50Z","modified":"2026-10-26T09:31:57.387616884Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792769794","title":"flatpak: Fix of CVE-2026-97023","description":"- CVE-2026-97023: fix arbitrary file deletion during deploy, where a malicious\n  ostree commit with \"export\" as a symlink made the path-based export/bin\n  cleanup delete files at the symlink target","status":"published","published":"2026-10-23T15:36:44Z","modified":"2026-10-26T09:32:01.390885463Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0477","title":"Updated flatpak package fixes security vulnerabilities","description":"Arbitrary file deletion in root context via path traversal in deploy\ndirectory export/bin. (CVE-2026-97023)\nArbitrary write in root context via path traversal in deploy directory\nfiles/etc. (CVE-2026-97024)\nWorld-readable oci authentication token in system-helper cache path.\n(CVE-2026-97025)\nWorld-writable temporary child repositories in system-helper cache path.\n(CVE-2026-97026)\nDenial of service via unsanitized keys in exported desktop entry / d-bus\nservice files. (CVE-2026-97027)\nSandboxed app can signal unsandboxed processes in the same process\ngroup. (CVE-2026-97029)\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.305195359Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11918-1","title":"flatpak-1.18.4-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-29T00:00:00Z","modified":"2026-09-30T18:23:13.972716879Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}