Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.5
CVE-2026-96284: Flatpak can expose system files through crafted symlink
CVE-2026-96284 · published 21 days ago
Summary
Flatpak on Canonical, Debian and Red Hat Enterprise Linux (versions 7, 8, and 10) may let a malicious user read files that belong to the system helper when an OCI repository is set up. The problem occurs because the helper follows symbolic links that an attacker can control, giving them access to hidden data. Until a patch is applied, avoid configuring system OCI repositories or limit who can add them, and apply the vendor’s update as soon as it is available.
What to do
- Update debian flatpak to version 1.14.10-1~deb12u2.
- Update debian flatpak to version 1.16.6-1~deb13u1.
- Update debian flatpak to version 1.16.4-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:18.04:LTS | canonical | flatpak | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | flatpak | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | flatpak | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | flatpak | All versions |
| Debian:12 | debian | flatpak |
< 1.14.10-1~deb12u2 Fix: upgrade to 1.14.10-1~deb12u2
|
| Debian:13 | debian | flatpak |
< 1.16.6-1~deb13u1 Fix: upgrade to 1.16.6-1~deb13u1
|
| Debian:14 | debian | flatpak |
< 1.16.4-1 Fix: upgrade to 1.16.4-1
|
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
Original advisory text
Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
References
- https://ubuntu.com/security/CVE-2026-96284 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-96284 Third Party Advisory
- https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc
- https://access.redhat.com/security/cve/CVE-2026-96284
- https://bugzilla.redhat.com/show_bug.cgi?id=2539423
- https://security-tracker.debian.org/tracker/CVE-2026-96284 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.5
Low
Type
CWE-59Link Following
Timeline
Published27 Sep 2026
Updated15 Oct 2026
First seen24 Sep 2026
Sources
UBUNTU-CVE-2026-96284 · OSV
CVE-2026-96284 · NVD
CVE-2026-96284 · MITRE
DEBIAN-CVE-2026-96284 · OSV
Track software like this
Free during beta