CVE-2026-96275

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description A malicious or compromised repository can write attacker-controlled content to arbitrary locations on the host filesystem. This occurs through the extract extra data() function. On system installations, this write operation is performed with root privileges. The issue results from a combination of two factors: the files/extra path is resolved using operations that follow symbolic links, and blob names originating from xa.extra-data-sources are not sanitized to prevent directory traversal using .. sequences.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.