Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Flatpak on AlmaLinux may delete or overwrite system files
published 10 days ago
Summary
The Flatpak packages for AlmaLinux can be tricked into deleting or modifying any file on the system because of a path handling error. This could let an attacker gain full control over the machine. Install the latest Flatpak updates from AlmaLinux as soon as possible to close the gap.
What to do
- Update almalinux flatpak to version 1.12.9-9.el8_10.
- Update almalinux flatpak-devel to version 1.12.9-9.el8_10.
- Update almalinux flatpak-libs to version 1.12.9-9.el8_10.
- Update almalinux flatpak-selinux to version 1.12.9-9.el8_10.
- Update almalinux flatpak-session-helper to version 1.12.9-9.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | flatpak |
< 1.12.9-9.el8_10 Fix: upgrade to 1.12.9-9.el8_10
|
| AlmaLinux:8 | almalinux | flatpak-devel |
< 1.12.9-9.el8_10 Fix: upgrade to 1.12.9-9.el8_10
|
| AlmaLinux:8 | almalinux | flatpak-libs |
< 1.12.9-9.el8_10 Fix: upgrade to 1.12.9-9.el8_10
|
| AlmaLinux:8 | almalinux | flatpak-selinux |
< 1.12.9-9.el8_10 Fix: upgrade to 1.12.9-9.el8_10
|
| AlmaLinux:8 | almalinux | flatpak-session-helper |
< 1.12.9-9.el8_10 Fix: upgrade to 1.12.9-9.el8_10
|
Original advisory text
Important: flatpak security update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:89859 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-97023 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-97024 Third Party Advisory
- https://bugzilla.redhat.com/2542625 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-89859.html Vendor Advisory
Timeline
Published26 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
ALSA-2026:89859 · OSV
Track software like this
Free during beta