Path Traversal and Arbitrary File Write in Flatpak

CVE-2026-96275 identifies a critical flaw in Flatpak's handling of extra data sources, specifically within the extract_extra_data() function. The vulnerability stems from two combined weaknesses: the resolution of files/extra paths that incorrectly follow symbolic links and the failure to sanitize blob names defined in the xa.extra-data-sources configuration. An attacker operating a malicious or compromised Flatpak repository can use directory traversal sequences, such as '..', within these blob names to escape intended directories and write content to arbitrary locations on the host. When Flatpak is utilized for system-wide installations, this process executes with root privileges, allowing an attacker to overwrite system files, place unauthorized binaries, or modify configuration files. This impacts any system relying on Flatpak for application management where untrusted repositories might be configured.

Impact

Successful exploitation allows for arbitrary file creation or modification on the host system. In scenarios involving system-wide Flatpak installations, this results in full root-level compromise of the host filesystem. This vulnerability affects Linux systems leveraging Flatpak for software distribution and management.

Recommendation

Prioritized actions for administrators and security teams:

• Audit configured Flatpak remotes and repositories to ensure only trusted sources are authorized.
• Monitor for unauthorized additions of new Flatpak repositories on production systems.
• Prioritize updates to the Flatpak runtime and core binaries as soon as security patches are released by upstream maintainers.
• Implement file integrity monitoring (FIM) on critical system directories, particularly those frequently targeted for persistent modifications, to detect anomalous file writes occurring from the flatpak binary or associated helper processes.