CVE-2026-96282

Published: Sep 27, 2026Modified: Sep 29, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 1.6 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (3)

https://access.redhat.com/security/cve/CVE-2026-96282

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2539422

Source: secalert@redhat.com

https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f

Source: secalert@redhat.com

Timeline

No history available yet.