CVE-2026-96275 in Red Hat
Summary
by MITRE • 09/23/2026
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Flatpak represents a critical security flaw within the application runtime environment's data extraction mechanism, specifically affecting the extract_extra_data function. This issue arises when an attacker controls or compromises a Flatpak repository, allowing them to exploit path resolution logic and insufficient input validation to write malicious content to arbitrary locations on the host filesystem. The severity of this vulnerability is significantly amplified by its execution context; during system-wide installations, these operations are performed with root privileges, thereby granting the attacker full control over the underlying operating system rather than just a sandboxed application environment.
The technical core of the flaw lies in two distinct but complementary failures within the Flatpak codebase. First, the resolution path for files located under the extra data directory utilizes standard file system operations that automatically follow symbolic links without adequate restriction or verification. This behavior allows an attacker to create symlinks pointing outside the intended sandboxed area. Second, and more critically, there is a lack of sanitization regarding blob names retrieved from the xa.extra-data-sources metadata attribute. Specifically, these names are not checked for directory traversal sequences such as double dots (..), which are standard indicators of path manipulation attempts in Unix-like systems.
When an attacker constructs a malicious repository containing extra data blobs with filenames that include relative path traversals like ../../etc/passwd or similar sensitive system paths, the Flatpak runtime processes these names directly into file write operations. Because the code follows symlinks during resolution and does not strip out traversal components from the blob name, the resulting file operation bypasses the intended isolation boundaries. The extracted content is written to the location specified by the traversed path rather than within the designated extra data directory for that specific application or runtime.
The operational impact of this vulnerability is severe due to the privilege level at which it executes on system installs. Since Flatpak often requires root access to install applications globally, a successful exploitation results in arbitrary file write as root. This capability allows an attacker to overwrite critical system binaries, inject malicious code into startup scripts, modify configuration files that dictate security policies, or plant backdoors in sensitive directories such as /etc, /usr/bin, or user home directories if those paths are accessible via traversal. In a multi-user environment, this could also lead to privilege escalation for other users by compromising shared resources or setting incorrect permissions on critical system files.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) and CWE-59: Improper Link Resolution Before File Access (Link Following). From an offensive security perspective, it maps closely to the ATT&CK technique T1036.004: Masquerading as System or Legitimate Process via file system manipulation, although more accurately it represents a supply chain attack vector where trust in the repository is abused to achieve initial code execution and privilege escalation on the host machine. The combination of symlink following and unsanitized path components creates a classic exploitation scenario that bypasses standard sandboxing expectations inherent in containerized or flatpak environments.
Mitigation strategies must address both the input validation and the file system interaction logic. Developers should implement strict sanitization of all blob names retrieved from metadata attributes, explicitly rejecting any strings containing directory traversal sequences such as .. or encoded variants thereof. Additionally, the path resolution mechanism for extra data files must be hardened to prevent symlink following during extraction operations. This can be achieved by using open flags that disallow symlinks, resolving paths in a way that verifies they remain within the intended base directory before any write operation occurs, and employing chroot or namespace restrictions where feasible. Until patches are applied, users should exercise extreme caution when adding third-party repositories to their Flatpak configuration and avoid system-wide installations from untrusted sources. Security monitoring tools should also be configured to detect unusual file writes in sensitive directories originating from flatpak processes as an indicator of compromise for this specific attack vector.