UBUNTU-CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

UBUNTU-CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted "directory" path, and a developer runs "flatpak build-init --writable-sdk --sdk-extension" with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function...

EUVD-2026-85343

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

The Flatpak tool is vulnerable to an arbitrary write in the host context via the flatpak build-init --writable-sdk --sdk-extension command. A malicious SDK container can declare an extension point with a crafted directory path containing .. traversal sequences. Because the target path is resolved...

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

EUVD-2026-85342

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: "files/extra" is resolved via path operations that follow symlinks, and blob...

CVE-2026-96275

The Flatpak package manager is vulnerable to an arbitrary write access as root. A malicious or compromised Flatpak repository can use the extract_extra_data() function to write attacker-controlled content to arbitrary locations on the host filesystem. The root cause stems from two combined issues...

vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App

Adobe has identified 9 vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App. These vulnerabilities are present in Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. The vulnerabilities concern various security issues in Adobe Connect, including SQL injection,...

CVE-2026-15358

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)

Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...

`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)

Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...