Bug 2542625 (CVE-2026-97024) - CVE-2026-97024 flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc
Summary: CVE-2026-97024 flatpak: flatpak: Arbitrary write in root context via path tra...
Keywords:
Status: NEW
Alias: CVE-2026-97024
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-28 19:51 UTC by OSIDB Bzimport
Modified: 2026-11-11 12:02 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:89849 0 None None None 2026-10-26 09:24:40 UTC
Red Hat Product Errata RHSA-2026:89850 0 None None None 2026-10-26 09:35:36 UTC
Red Hat Product Errata RHSA-2026:89859 0 None None None 2026-10-26 10:28:42 UTC
Red Hat Product Errata RHSA-2026:95061 0 None None None 2026-11-04 11:01:24 UTC
Red Hat Product Errata RHSA-2026:95062 0 None None None 2026-11-04 09:34:04 UTC
Red Hat Product Errata RHSA-2026:95063 0 None None None 2026-11-04 10:01:13 UTC
Red Hat Product Errata RHSA-2026:95064 0 None None None 2026-11-04 10:02:01 UTC
Red Hat Product Errata RHSA-2026:98490 0 None None None 2026-11-11 12:02:07 UTC
Red Hat Product Errata RHSA-2026:98595 0 None None None 2026-11-11 11:27:12 UTC

Description OSIDB Bzimport 2026-09-28 19:51:44 UTC 
GHSA-8xgq-v545-vgvf (https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf)

Description: A path traversal vulnerability during app installation could be used by an attacker to overwrite system files. A malicious Flatpak app could arrange for files named "passwd", "group", or "machine-id" on the host system (e.g. /etc/passwd) to be emptied when the app is upgraded, resulting in data loss and loss of access to the system. When installing Flatpak apps system-wide, the file write is done by root. It is not believed to be possible to replace these files with attacker-chosen content. Similarly, a malicious app could arrange for files named "resolv.conf" to be replaced by a symbolic link to /run/host/monitor/resolv.conf, which is unlikely to exist on the host system.

Mitigation: No known mitigation other than updating. Patched in 1.18.4 by commits 01cd7c4b ("dir: Add fd-relative helpers for accessing deploy directories") and cc3ab6ab ("dir: Use fd-relative operations for files/etc during runtime deploy"). The changes overlap with those for GHSA-5p67-xh8x-rq54 (CVE-2026-97023).
Comment 1 Jon Orris 2026-10-26 09:24:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:89849 https://access.redhat.com/errata/RHSA-2026:89849
Comment 2 Jon Orris 2026-10-26 09:35:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:89850 https://access.redhat.com/errata/RHSA-2026:89850
Comment 3 Jon Orris 2026-10-26 10:28:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:89859 https://access.redhat.com/errata/RHSA-2026:89859
Comment 4 Jon Orris 2026-11-04 09:34:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:95062 https://access.redhat.com/errata/RHSA-2026:95062
Comment 5 Jon Orris 2026-11-04 10:01:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:95063 https://access.redhat.com/errata/RHSA-2026:95063
Comment 6 Jon Orris 2026-11-04 10:02:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:95064 https://access.redhat.com/errata/RHSA-2026:95064
Comment 7 Jon Orris 2026-11-04 11:01:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:95061 https://access.redhat.com/errata/RHSA-2026:95061
Comment 8 errata-xmlrpc 2026-11-11 11:27:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98595 https://access.redhat.com/errata/RHSA-2026:98595
Comment 9 errata-xmlrpc 2026-11-11 12:02:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98490 https://access.redhat.com/errata/RHSA-2026:98490
Note You need to log in before you can comment on or make changes to this bug.