flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. See https://flatpak.org/ for more information. Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quic...

easyssh

EasySSH The SSH connection manager to make your life easier. Looking for maintainers! A complete, efficient and easy-to-use manager. Create and edit connections, groups, customize the terminal, with multiple instances of the same connection. Features Manage connections and groups Customize termin...

gdb-frontend

GDBFrontend is an easy, flexible and extensionable gui debugger. Installing Requirements GDB = 8.2 with python3 python3 = 3.6 tmux PIP Package Python Wheel Recommended You can install GDBFrontend with pip. root@kitploit: sudo python3 -m pip install gdbfrontend if it is already installed and you a...

CVE-2026-92162

CVE-2026-92162: Flatpak DeployAppstream arch Path Traversal Educational write up and test mode proof of concept for a path traversal in the Flatpak system helper flatpak-system-helper. The DeployAppstream D-Bus method accepts an arch string that is placed into a filesystem path and created as roo...

CVE-2026-96807

A flaw was found in Flatpak. A malicious sandboxed application can manipulate a symlink, causing the regenerateldcache function to write files to an unintended location. While the attacker cannot control the content or filenames, this vulnerability could lead to a low impact on system integrity o...

CVE-2026-96808

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit...

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

DEBIAN-CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96276

The Flatpak tool is vulnerable to an arbitrary write in the host context via the flatpak build-init --writable-sdk --sdk-extension command. A malicious SDK container can declare an extension point with a crafted directory path containing .. traversal sequences. Because the target path is resolved...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

EUVD-2026-85342

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96275

The Flatpak package manager is vulnerable to an arbitrary write access as root. A malicious or compromised Flatpak repository can use the extract_extra_data() function to write attacker-controlled content to arbitrary locations on the host filesystem. The root cause stems from two combined issues...