CVE-2026-96279

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description A malicious OCI registry can hardlink arbitrary host files into the extraction directory during the installation or update of a Flatpak application from an OCI remote. This allows for the disclosure of arbitrary host file contents. In the case of system-wide installations running as root, this could include sensitive files such as /etc/shadow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.