CVE-2026-96275

CVE-2026-96275 is a path traversal vulnerability in Flatpak's extract_extra_data() function that allows writing attacker-controlled content to arbitrary locations on the host filesystem. The flaw is triggered when processing a malicious or compromised Flatpak repository that uses specially crafted `files/extra` paths (via symlinks) and `xa.extra-data-sources` blob names containing `..` traversal sequences. On system-wide Flatpak installations, this write operation occurs with root privileges, leading to a complete system compromise. The vulnerability affects all Flatpak versions prior to the fix in 1.18.1, and there are no known public exploits or in-the-wild exploitation as of the advisory.

What to do: Upgrade to Flatpak version 1.18.1 or later, as this version contains the fix for the path traversal vulnerability. Users should only install Flatpak applications from trusted repositories to avoid exposure to malicious repository definitions. System administrators should check for any unauthorized or suspicious Flatpak repositories configured on their hosts.