Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Flatpak may delete or alter files on Linux systems

published 8 days ago

Summary

Flatpak, the tool used to run sandboxed desktop applications on Linux, has a flaw that lets an attacker remove or write any file on the system by using specially crafted paths. This could let a malicious program tamper with important system files or erase data. Install the latest Flatpak update from Rocky Linux as soon as possible to close the problem.

What to do

Update rocky flatpak to version 0:1.12.9-4.el9_8.6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	flatpak	< 0:1.12.9-4.el9_8.6 Fix: upgrade to 0:1.12.9-4.el9_8.6

Original advisory text

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)

* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:89850 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2542606 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2542625 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:89850 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.1 High

Timeline

Published27 Oct 2026

Updated27 Oct 2026

First seen27 Oct 2026

Sources

RLSA-2026:89850 · OSV

Track software like this

Free during beta