CVE-2026-97023

A UNIX path traversal flaw (CWE-61) in Flatpak's handling of an application's export/bin directory during deployment allows a malicious Flatpak app to delete attacker-chosen files outside its own deployment directory when the app is installed or upgraded. On system-wide installations, that deletion is performed with root privileges, giving an attacker arbitrary file deletion and the ability to corrupt or break the host. Exploitation requires user interaction — the victim must install or upgrade the attacker's malicious app, for example from an untrusted remote — and yields no direct confidentiality impact, consistent with the CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/C:N/I:L/A:H). All users of affected Flatpak versions on Linux desktops are potentially exposed, with the highest risk on systems where apps are installed system-wide by root. No public proof of concept is known and the flaw is not listed in CISA's KEV, so exploitation status is currently none known.

What to do: Upgrade Flatpak to 1.18.4 or later, or apply your distribution's backported security patch as soon as it ships. Restrict app installs and upgrades to trusted remotes such as Flathub, since the flaw requires the victim to install a malicious app. Prefer per-user Flatpak installs where practical (limiting deletions to user files rather than root-level deletion), and audit hosts for unexpected file deletion outside /var/lib/flatpak and ~/.local/share/flatpak following recent app installs or upgrades.