Bug 2539422 (CVE-2026-96282)

Summary:	CVE-2026-96282 flatpak: flatpak: Extension metadata path traversal file existence oracle
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-23 14:04:41 UTC

GHSA-w69g-9x8j-7p8f (https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f)

Description: When Flatpak launches an application, it performs host-side file operations inside extension content directories to set up bind mounts and symlinks, using path-based APIs that follow symlinks without confinement. Since an extension's files directory is entirely controlled by the extension developer, a malicious extension can place symlinks pointing at arbitrary host paths. Flatpak follows symlinks in the extension content when checking for the .ref lock marker file and when iterating merge_dirs directories; for merge_dirs, the host-side directory listing is reflected into the sandbox as symlinks the application can enumerate, disclosing filenames from arbitrary host directories. Separately, extension metadata fields (directory, subdir_suffix, add_ld_path, merge_dirs) were not validated for path traversal, allowing extension content to be mounted at unintended sandbox locations.

Mitigation: Avoid installing Flatpak extensions from untrusted sources; there is no configuration to disable extension processing without removing the extensions. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.