1859 matches found
UBUNTU-CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97023 Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
EUVD-2026-88442
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97023 Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97023
A path traversal vulnerability exists in Flatpak during the handling of the export/bin directory during app deployment. This flaw allows a malicious Flatpak app to trigger the deletion of arbitrary files outside the deployment directory when an app is installed or upgraded. Notably, in system-wid...
CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
[SECURITY] [DSA 6524-1] flatpak security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6524-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 28, 2026 https://www.debian.org/security/faq -...
PT-2026-102381
Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description Flatpak fails to validate vendor-extension keys against an allowlist when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, passing them through unmodified. ...
CVE-2026-97027: Improper Input Validation
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service e.g. forced application restart...
CVE-2026-97023: UNIX Symbolic Link (Symlink) Following
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
CVE-2026-97026: Creation of Temporary File With Insecure Permissions
Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...
PT-2026-102380
Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description Flatpak creates temporary child repository directories within the user cache using world-writable permissions 0777. On multi-user systems with a permissive umask a file mode mask that...
PT-2026-102379
Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description Flatpak writes the OCI Open Container Initiative repository authentication token with world-readable permissions 0644 in the system-helper's cache directory. This allows other local users on ...
CVE-2026-97025: Creation of Temporary File With Insecure Permissions
Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...
Important: flatpak
Issue Overview: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g.,...
PT-2026-102330
Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A path traversal issue exists in the way the software handles the export/bin directory during app deployment. This allows a malicious application to trigger the deletion of arbitrary files...
CVE-2026-96284
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...
DEBIAN-CVE-2026-96284
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...