CVE-2026-96275: Flatpak Path Traversal Vulnerability

CVE-2026-96275 Overview

CVE-2026-96275 is a path traversal vulnerability [CWE-22] in Flatpak, the Linux application sandboxing and distribution framework. A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem through the extract_extra_data() function. On system installations, the write executes with root privileges, giving attackers a direct route to full host compromise.

The flaw combines two defects: files/extra is resolved through path operations that follow symbolic links, and blob names from xa.extra-data-sources are not sanitized against .. traversal sequences. Together, these issues break out of the intended extraction directory.

Critical Impact
An attacker controlling a Flatpak repository can achieve arbitrary file write as root on any system that installs or updates an affected application, enabling full system compromise.

Affected Products

Flatpak (application sandboxing framework for Linux)
Linux distributions shipping vulnerable Flatpak versions, including Red Hat Enterprise Linux
System-wide Flatpak installations using remote repositories with extra-data support

Discovery Timeline

2026-09-23 - CVE-2026-96275 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96275

Vulnerability Analysis

Flatpak supports an extra-data mechanism that lets applications ship supplementary payloads fetched at install time. The extract_extra_data() routine unpacks these blobs into the application's files/extra directory inside the deployment tree. The vulnerability arises because Flatpak trusts two attacker-controllable inputs during this process: the resolved destination path and the blob file names listed in the repository metadata key xa.extra-data-sources.

Because path resolution follows symbolic links, an attacker who can influence the deployment tree can redirect files/extra to any location on the host. Because blob names are not filtered for .. sequences, attackers can also traverse upward from the intended directory. On system installations, the extraction runs as root, so the resulting file write inherits root privileges.

Exploitation requires user interaction (UI:R) — the victim must install or update an application from the malicious remote. However, once the interaction occurs, the attacker gains arbitrary write on the host filesystem, which is trivially escalated to code execution by writing to locations such as /etc/cron.d/, /etc/ld.so.preload, or systemd unit directories.

Root Cause

The root cause is insufficient input validation combined with unsafe filesystem operations in extract_extra_data(). Two specific defects converge: path resolution for files/extra uses APIs that dereference symbolic links rather than operating on file descriptors relative to a trusted directory, and blob names originating from xa.extra-data-sources metadata are written to disk without stripping directory separators or .. components. Neither check is enforced before the file write.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious Flatpak repository or compromises a legitimate one, then publishes an application whose commit metadata includes crafted xa.extra-data-sources entries. When a user adds the remote and installs or updates the application, Flatpak fetches the extra-data blobs and writes them to attacker-chosen paths. On system installs, the write occurs as root and can overwrite security-critical files or drop new executables into privileged locations. Full technical details are available in the GitHub Flatpak Security Advisory.

No verified public exploit code is available. The vulnerability mechanism is described in prose per the linked advisories.

Detection Methods for CVE-2026-96275

Indicators of Compromise

Unexpected files appearing outside /var/lib/flatpak/app/<app-id>/ or ~/.local/share/flatpak/app/<app-id>/ shortly after a Flatpak install or update.
Modifications to sensitive system paths such as /etc/cron.d/, /etc/ld.so.preload, /etc/systemd/system/, or /usr/local/bin/ correlated with flatpak install or flatpak update activity.
Presence of Flatpak commit metadata containing xa.extra-data-sources entries with blob names that include .., /, or absolute paths.
Newly added Flatpak remotes pointing to untrusted or recently registered domains.

Detection Strategies

Audit Flatpak repository metadata for xa.extra-data-sources entries and flag any blob name containing path separators or traversal sequences.
Monitor process ancestry for flatpak-system-helper or flatpak writing files to paths outside the expected deployment roots.
Correlate package manager and Flatpak activity with filesystem change events on protected directories using file integrity monitoring.
Log and review all flatpak remote-add operations, especially those performed with --system.

Monitoring Recommendations

Enable Linux audit rules (auditd) on /etc/, /usr/local/, and systemd unit directories to catch out-of-policy writes originating from Flatpak processes.
Forward Flatpak transaction logs and audit events to a centralized data lake for correlation across hosts.
Alert on any root-privileged file creation events whose parent process is flatpak-system-helper.

How to Mitigate CVE-2026-96275

Immediate Actions Required

Upgrade Flatpak to the patched version distributed by your Linux vendor as soon as it is available. Consult the Red Hat CVE-2026-96275 Advisory for distribution-specific packages.
Inventory all configured Flatpak remotes on managed hosts and remove any that are untrusted or unnecessary.
Pause automated system-wide Flatpak installs and updates from third-party remotes until patching is complete.
Review recent Flatpak install and update history on system installations for signs of exploitation.

Patch Information

Refer to the upstream fix tracked in the GitHub Flatpak Security Advisory and vendor backports such as the Red Hat Bug Report #2539416. The patch sanitizes blob names from xa.extra-data-sources against traversal sequences and uses symlink-safe filesystem operations when resolving files/extra.

Workarounds

Restrict Flatpak usage to per-user installations (--user) where the write privilege is limited to the invoking user rather than root.
Remove or disable untrusted remotes with flatpak remote-delete <name> until the patched version is deployed.
Enforce mandatory access controls (SELinux, AppArmor) that restrict flatpak-system-helper from writing outside expected deployment directories.
Require administrative approval for adding new system-wide Flatpak remotes in managed environments.

bash

# List and remove untrusted system-wide Flatpak remotes
flatpak remotes --system
sudo flatpak remote-delete --system <untrusted-remote-name>

# Prefer per-user installations until patched
flatpak --user remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak --user install <app-id>

# Verify installed Flatpak version against the vendor-patched release
flatpak --version