CVE-2026-96808

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1

Description The revokefs writer, utilized by the flatpak-system-helper to receive repository data from unprivileged callers, fails to prevent symlink traversal despite rejecting literal .. components in file paths. A malicious local user with an active session can establish two revokefs sessions via the system helper and create a symlink in one session that points to the other session's directory. By retaining a file descriptor through this symlink, the attacker can modify files in a different revokefs session after they have been validated and imported. This allows for the tampering of ostree commit objects in the system repository following signature verification, leading to root-controlled file writes to arbitrary paths and local root privilege escalation.

Recommendations Update to version 1.18.1 or later.