Path traversal in Flatpak - CVE-2026-97023

Vulnerability identifier: #VU152568

CSH Severity: Medium

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97023

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to delete arbitrary files outside the deployment directory.

The vulnerability exists due to path traversal in the export/bin handling in deploy directories when upgrading a malicious Flatpak app. A remote attacker can supply a malicious Flatpak app with crafted paths to delete arbitrary files outside the deployment directory.

User interaction is required to upgrade the malicious app. For system-wide installations, file deletion is performed as root.

Flatpak
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
flatpak-debuginfo (Red Hat package)
flatpak-debugsource (Red Hat package)
flatpak-libs-debuginfo (Red Hat package)
flatpak-session-helper-debuginfo (Red Hat package)
flatpak-devel (Red Hat package)
flatpak (Red Hat package)
flatpak
flatpak-devel
flatpak-libs
flatpak-session-helper
flatpak-tests
flatpak-doc
flatpak-selinux
flatpak (Debian package)

Install security update from vendor's website.

Flatpak - update to 1.18.4
flatpak-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-debugsource (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-libs-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-session-helper-debuginfo (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak-devel (Red Hat package) - update to 1.12.9-4.el9_8.6
flatpak (Red Hat package) - addressed in versions 1.12.9-9.el8_10, 1.16.0-9.el10_2.6
flatpak - update to 1.18.4-1
flatpak-devel - update to 1.18.4-1
flatpak-libs - update to 1.18.4-1
flatpak-session-helper - update to 1.18.4-1
flatpak-tests - update to 1.18.4-1
flatpak-doc - update to 1.18.4-1
flatpak-selinux - update to 1.18.4-1
flatpak (Debian package) - update to 1.16.6-1~deb13u3

• https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
• https://github.com/flatpak/flatpak/commit/40f1265c26fed576235b7a8748371e274b44de1c

• Multiple vulnerabilities in Flatpak
• Anolis OS update for flatpak
• Red Hat Enterprise Linux 10 update for flatpak
• Red Hat Enterprise Linux 9 update for flatpak
• Red Hat Enterprise Linux 8 update for flatpak
• Debian update for flatpak