CVE-2026-96276

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description A flaw exists where a malicious SDK container can trigger arbitrary file writes on the host system. This occurs when a developer executes the command flatpak build-init --writable-sdk --sdk-extension using an SDK that declares an extension point with a crafted directory path. The issue stems from the use of a function that fails to properly handle directory traversal, allowing the use of .. sequences to resolve paths outside the intended working directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.