CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A path traversal issue in the Flatpak OCI archive extraction process allows a malicious OCI registry to hardlink arbitrary host files into the extraction directory. This occurs when a user installs or updates a Flatpak application from an OCI remote, potentially leading to the disclosure of sensi...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2025-11395

Podman is affected by an arbitrary file write vulnerability that occurs when importing an OCI archive via the podman load command. An attacker who can supply a crafted tar archive to this command can create files on the host with the privileges of the user running Podman. The flaw is scored CVSS ...

CVE-2025-11395 Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...