PT-2026-105461 · Debian+2 · Flatpak

CVE-2026-92162

Published

2026-09-22

Updated

2026-10-09

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

This update for flatpak fixes the following issues:

CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
CVE-2026-96283: flatpak-system-helper: cross-user CancelPull orphans another user's ongoing pull (bsc#1282521).
CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-92162

SUSE-SU-2026:4610-1

Flatpak