CVE-2026-97024: Flatpak Path Traversal Vulnerability

CVE-2026-97024 Overview

CVE-2026-97024 is a path traversal vulnerability in Flatpak's handling of the files/etc directory during application deployment. A malicious Flatpak application can cause specific host system files, such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf, to be emptied or replaced with a symbolic link when the app is installed or upgraded. In system-wide installations, Flatpak performs these writes as root, extending the impact to privileged files across the host. The flaw is tracked as [CWE-61] (UNIX Symbolic Link Following) and affects Flatpak users who install applications from untrusted sources.

Critical Impact
A malicious Flatpak app installed system-wide can overwrite or symlink root-owned host files, causing denial of service and configuration tampering on the host operating system.

Affected Products

Flatpak application deployment framework (see GitHub Flatpak Security Advisory GHSA-8xgq-v545-vgvf)
Linux distributions shipping vulnerable Flatpak builds (see Red Hat CVE-2026-97024 Advisory)
System-wide Flatpak installations where flatpak runs as root

Discovery Timeline

2026-09-29 - CVE CVE-2026-97024 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97024

Vulnerability Analysis

Flatpak deploys applications by extracting content from an OSTree-backed repository into a per-application directory. During deployment, Flatpak processes the application's files/etc subtree to stage configuration data that later merges with host state. The vulnerability arises because Flatpak does not adequately validate symbolic links or path components within files/etc before performing write operations. A crafted application can therefore direct Flatpak to write outside the intended deployment directory.

Because system-wide installations execute the deployment logic as root, the resulting writes inherit root privileges. An attacker can truncate sensitive host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf, or replace them with attacker-controlled symlinks. Emptying /etc/passwd or /etc/group breaks account resolution and can prevent successful login. Corrupting /etc/resolv.conf disrupts name resolution. Overwriting /etc/machine-id breaks identity-dependent services.

Root Cause

The root cause is unsafe handling of symbolic links in the files/etc staging path, classified as [CWE-61]. Flatpak follows or creates links relative to a directory an untrusted package controls, without confining operations to the deployment tree.

Attack Vector

Exploitation requires the victim to install or upgrade a malicious Flatpak application. The packaged application carries a specially crafted files/etc layout that redirects file operations to host paths. In per-user installations the impact is limited to files writable by the user. In system-wide installations the writes run as root, enabling host-level tampering. No authentication of the attacker to the host is required beyond convincing a user or administrator to install the package.

For technical specifics on the affected code paths, see the GitHub Flatpak Security Advisory GHSA-8xgq-v545-vgvf and the Red Hat Bug Report #2542625.

Detection Methods for CVE-2026-97024

Indicators of Compromise

Unexpected zero-byte or symlinked host files at /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf following a Flatpak install or upgrade.
Flatpak deployment logs referencing recently installed or upgraded applications from untrusted remotes such as third-party repositories.
Sudden failures of user authentication, name resolution, or D-Bus services correlated with flatpak install or flatpak update invocations.

Detection Strategies

Monitor process execution of flatpak running as root and correlate with file modification events under /etc.
Alert on symbolic link creation or file truncation events targeting /etc/passwd, /etc/shadow, /etc/group, /etc/machine-id, and /etc/resolv.conf.
Track installation of Flatpak applications from remotes other than vetted sources such as Flathub verified publishers.

Monitoring Recommendations

Enable audit rules (auditd) on critical /etc files to record write, truncate, and rename operations with the responsible process context.
Collect Flatpak client logs and OSTree deployment metadata into a centralized log store for retrospective review.
Baseline file integrity for the listed host files and alert on hash or file-type changes.

How to Mitigate CVE-2026-97024

Immediate Actions Required

Apply the patched Flatpak build supplied by your Linux distribution as soon as it is available. Track vendor status at the Red Hat CVE-2026-97024 Advisory.
Refrain from installing or upgrading Flatpak applications from untrusted remotes until the patch is deployed.
Audit system-wide Flatpak installations and verify integrity of /etc/passwd, /etc/group, /etc/machine-id, and /etc/resolv.conf.

Patch Information

Refer to the upstream fix and distribution advisories listed in the GitHub Flatpak Security Advisory GHSA-8xgq-v545-vgvf and the Red Hat Bug Report #2542625 for fixed package versions. Apply updates through your distribution package manager and restart affected services after patching.

Workarounds

Prefer per-user Flatpak installations (flatpak install --user) so deployment operations do not run as root.
Restrict Flatpak remotes to trusted, curated sources and disable auto-updates from unverified publishers.
Enforce file integrity monitoring on critical /etc files to detect tampering promptly.

bash

# Configuration example: remove untrusted remotes and prefer per-user installs
flatpak remotes --system
flatpak remote-delete --system <untrusted-remote>
flatpak install --user flathub <application-id>