CVE-2026-92162

CVE-2026-92162: Flatpak DeployAppstream arch Path Traversal Educational write up and test mode proof of concept for a path traversal in the Flatpak system helper flatpak-system-helper. The DeployAppstream D-Bus method accepts an arch string that is placed into a filesystem path and created as roo...

SUSE SLES12 Security Update : flatpak (SUSE-SU-2026:4610-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4610-1 advisory. - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on...

CVE-2026-92162

The Flatpak application deployment framework is vulnerable to a path traversal vulnerability in the DeployAppstream D-Bus method. The issue stems from the flatpak-system-helper process failing to validate the arch parameter, allowing a malicious local user to supply ../ components. This can trick...

CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

PT-2026-105461

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1 Description On systems with at least one OCI Open Container Initiative remote configured, a malicious local user in an active session can use a crafted architecture name to trick the flatpak-system-helper...