Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.9
CVE-2026-97026: Flatpak lets any local user modify install temp files
CVE-2026-97026 · published 20 days ago
Summary
Flatpak on Debian and Red Hat Enterprise Linux (versions 7‑10) creates temporary folders for installing apps that are set so anyone on the computer can read or change them. On a machine where users share the same computer, another user could interfere with an installation, causing it to fail. Fix it by applying the latest Flatpak update or changing the system’s default file permission settings so these folders are private.
What to do
- Update debian flatpak to version 1.16.6-1~deb13u3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | flatpak | All versions |
| Debian:13 | debian | flatpak |
< 1.16.6-1~deb13u3 Fix: upgrade to 1.16.6-1~deb13u3
|
| Debian:14 | debian | flatpak | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | flatpak | All versions |
Original advisory text
Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.
References
- https://security-tracker.debian.org/tracker/CVE-2026-97026 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-97026 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542637 Third Party Advisory
- https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-97026 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-97026 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.9
Low
Type
CWE-378Creation of Temporary File With Insecure Permissions
Timeline
Published28 Sep 2026
Updated17 Oct 2026
First seen28 Sep 2026
Sources
DEBIAN-CVE-2026-97026 · OSV
CVE-2026-97026 · NVD
CVE-2026-97026 · MITRE
UBUNTU-CVE-2026-97026 · OSV
Track software like this
Free during beta