by Kastro
Paper/Archive/CVE-2026-96276

CVE-2026-96276

Red Hat Red Hat Enterprise Linux 10 — Flatpak: flatpak: arbitrary write in host context via flatpak build-init

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.9.379 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

Affected

ProductAffectedFixed inSource
Red Hat Enterprise Linux 10see advisory–CNA
Red Hat Enterprise Linux 7see advisory–CNA
Red Hat Enterprise Linux 8see advisory–CNA
Red Hat Enterprise Linux 9see advisory–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaccess.redhat.com/security/cve/CVE-2026-96276refbugzilla.redhat.com/show_bug.cgi?id=2539418refgithub.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm