CVE-2026-97023: Flatpak Path Traversal Vulnerability

CVE-2026-97023 Overview

CVE-2026-97023 is a path traversal vulnerability in Flatpak, the Linux application sandboxing and distribution framework. The flaw exists in Flatpak's handling of the export/bin directory during application deployment. A malicious Flatpak app can trigger deletion of attacker-chosen files outside its deployment directory when the app is installed or upgraded. In system-wide installations, Flatpak performs the deletion as root, allowing removal of arbitrary files on the host filesystem. The vulnerability is classified as [CWE-61] UNIX Symbolic Link Following.

Critical Impact
A crafted Flatpak application can delete arbitrary files on the host system, including system-critical files when installed system-wide as root, leading to denial of service or system integrity loss.

Affected Products

Flatpak (application sandboxing framework for Linux)
Linux distributions shipping vulnerable Flatpak versions (including Red Hat)
System-wide Flatpak installations where operations execute as root

Discovery Timeline

2026-09-28 - CVE-2026-97023 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97023

Vulnerability Analysis

Flatpak exports application-provided binaries and metadata from an app's deployment directory into a shared export/bin location so wrapper scripts appear on the host. During install and upgrade operations, Flatpak removes stale exported entries before writing new ones. The cleanup routine does not properly validate that entries within export/bin resolve inside the intended directory. A malicious app bundle can place symbolic links or path components in its export tree that redirect these deletion operations to arbitrary paths outside the deployment directory. Because system-wide installations run with elevated privileges, the resulting unlink operations execute as root and can remove files anywhere on the host filesystem.

Root Cause

The root cause is unsafe symbolic link handling during export cleanup, tracked under [CWE-61] UNIX Symbolic Link Following. Flatpak follows symlinks in the export/bin path when removing exported binaries, rather than resolving and validating that each target resides within the trusted deployment root. Attacker-controlled content inside the app bundle influences which paths the deletion loop touches.

Attack Vector

Exploitation requires a victim to install or upgrade a malicious Flatpak application. The attack vector is network-reachable in the sense that Flatpak apps are distributed through remotes, but user interaction is required to trigger the install or upgrade. Once triggered, Flatpak's export cleanup follows attacker-supplied symlinks and deletes the target files. In system-wide installations, deletion runs as root, enabling removal of system binaries, configuration files, or security-relevant data. The vulnerability does not directly provide code execution or data disclosure, but arbitrary file deletion can produce denial of service and destabilize dependent services.

No public proof-of-concept exploit code is currently available. Refer to the GitHub Flatpak Security Advisory GHSA-5p67-xh8x-rq54 for authoritative technical details.

Detection Methods for CVE-2026-97023

Indicators of Compromise

Unexpected removal of files under system directories such as /etc, /usr/bin, or /var immediately following a flatpak install or flatpak update operation.
Presence of symbolic links inside a Flatpak bundle's files/export/bin tree that point outside the app's deployment directory.
Installation of Flatpak applications from untrusted or unverified remotes shortly before file loss events.

Detection Strategies

Audit Flatpak install and upgrade activity by monitoring flatpak process invocations and correlating them with subsequent unlink or unlinkat syscalls on paths outside /var/lib/flatpak.
Inspect application bundles prior to deployment for symlinks in the export/bin directory that resolve to absolute paths or use .. traversal.
Enable Linux audit rules on sensitive directories to capture file deletions performed by the flatpak-system-helper process running as root.

Monitoring Recommendations

Alert on file integrity monitoring events for critical system paths that coincide with Flatpak transaction logs in /var/log.
Track Flatpak remote additions and installations from non-vetted sources across managed Linux endpoints.
Correlate root-owned deletion events with the initiating user session to attribute changes to specific Flatpak operations.

How to Mitigate CVE-2026-97023

Immediate Actions Required

Upgrade Flatpak to the patched version identified in the GitHub Flatpak Security Advisory GHSA-5p67-xh8x-rq54 as soon as vendor packages are available.
Restrict Flatpak installations to trusted remotes such as Flathub verified publishers, and remove untrusted remotes with flatpak remote-delete.
Prefer per-user installations with flatpak install --user where feasible to avoid deletions executed as root.

Patch Information

Refer to the Red Hat CVE-2026-97023 Advisory for distribution-specific package updates and to the GitHub Flatpak Security Advisory GHSA-5p67-xh8x-rq54 for the upstream fix. Apply vendor-supplied Flatpak updates through your distribution's package manager once available.

Workarounds

Avoid installing or upgrading Flatpak apps from unverified sources until the patched version is deployed.
Review third-party Flatpak bundles for suspicious symlinks under files/export/bin before installation.
Where system-wide installations are not required, migrate to --user scope installations to limit deletion privileges to the invoking user.

bash

# Configuration example: list configured remotes and remove untrusted ones
flatpak remotes --show-details
flatpak remote-delete <untrusted-remote-name>

# Prefer user-scope installation to avoid root-privileged deletions
flatpak install --user flathub <app-id>