Advisory · CVE-2026-96275
Malicious Flatpak repositories can write anywhere as root
A compromised Flatpak repository can write attacker-controlled content to arbitrary host filesystem locations through extract_extra_data, running as root on system installs via symlink following and unsanitized path traversal.
- Vendor
- Flatpak
- Product
- Flatpak
- Identifier / CWE
- CVE-2026-96275
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Flatpak installs apps from app stores, and a rigged store can slip a note saying 'put this file wherever I say.' Flatpak follows the instructions without checking the address, so the file can land anywhere on the computer, even in the most protected drawers.
- 01Untrusted repository
A user adds or updates from a malicious or compromised Flatpak repository.
- 02Extra data
The repository serves extra-data blobs whose names come from xa.extra-data-sources without sanitization against .. traversal.
- 03Symlink path
The files/extra destination is resolved with path operations that follow symlinks.
- 04Arbitrary write
Attacker-controlled content is written to arbitrary host filesystem locations, as root on system installs.
What happened
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). Two issues combine: files/extra is resolved through path operations that follow symlinks, and blob names taken from xa.extra-data-sources are not sanitized against .. traversal. On system installs the write happens as root, which turns a repository compromise into full host compromise.
The issue is reported against Flatpak as shipped in Red Hat Enterprise Linux 7 through 10 and rated high at CVSS 8.8. The upstream project published a GitHub security advisory, GHSA-fqx6-vh4p-42cg. No fixed version is stated in the data available, so remediation should follow the project advisory and the Red Hat bulletin.
What to do
- Upgrade Flatpak following the upstream advisory and your distribution’s security bulletin.
- Audit configured remotes and remove or re-verify any repository you do not fully trust.
- Prefer user installs over system installs where practical to reduce the privilege of the write path.
- On systems that updated from third-party remotes, check for unexpected files in sensitive host locations.
Management note
Flatpak’s sandboxing story assumes the repository is trustworthy, and this flaw shows what happens when that assumption breaks: the sandbox never even enters the picture because the damage happens at install time, as root. Repository trust is the control that matters here.