Vulnerability Description
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:80497
- https://access.redhat.com/errata/RHSA-2026:80498
- https://access.redhat.com/errata/RHSA-2026:80687
- https://access.redhat.com/security/cve/CVE-2026-96275
- https://bugzilla.redhat.com/show_bug.cgi?id=2539416
- https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
FAQ
What is CVE-2026-96275?
CVE-2026-96275 is a vulnerability with a CVSS score of 8.8 (HIGH). A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as roo...
How severe is CVE-2026-96275?
CVE-2026-96275 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-96275?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.