Path traversal in Flatpak - CVE-2026-97024

Vulnerability identifier: #VU152567

CSH Severity: Medium

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97024

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause data loss and loss of access to the system.

The vulnerability exists due to path traversal in files/etc handling in deploy directories when upgrading a malicious Flatpak app. A remote attacker can supply a malicious Flatpak app containing crafted files to overwrite system files and cause data loss and loss of access to the system.

User interaction is required to upgrade the malicious app.

Flatpak
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
flatpak-debuginfo (Red Hat package)
flatpak-debugsource (Red Hat package)
flatpak-libs-debuginfo (Red Hat package)
flatpak-session-helper-debuginfo (Red Hat package)
flatpak-devel (Red Hat package)
flatpak (Red Hat package)
flatpak
flatpak-devel
flatpak-libs
flatpak-session-helper
flatpak-tests
flatpak-doc
flatpak-selinux
flatpak (Debian package)

Install security update from vendor's website.

Flatpak - update to 1.18.4
flatpak-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-debugsource (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-libs-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-session-helper-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-devel (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak (Red Hat package) - addressed in versions 1.12.9-9.el8_10, 1.16.0-9.el10_2.6
flatpak - update to 1.18.4-1
flatpak-devel - update to 1.18.4-1
flatpak-libs - update to 1.18.4-1
flatpak-session-helper - update to 1.18.4-1
flatpak-tests - update to 1.18.4-1
flatpak-doc - update to 1.18.4-1
flatpak-selinux - update to 1.18.4-1
flatpak (Debian package) - update to 1.16.6-1~deb13u3

• https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
• https://github.com/flatpak/flatpak/commit/cc3ab6ab45b9cbca5a360608c51eb336a749d0e8

• Multiple vulnerabilities in Flatpak
• Anolis OS update for flatpak
• Red Hat Enterprise Linux 10 update for flatpak
• Red Hat Enterprise Linux 9 update for flatpak
• Red Hat Enterprise Linux 8 update for flatpak
• Debian update for flatpak