Flatpak System-Helper Symlink Traversal Grants File Read
CVE-2026-96284 Published on September 27, 2026
Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
Vulnerability Analysis
CVE-2026-96284 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-96284 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-96284
Want to know whenever a new CVE is published for Red Hat Enterprise Linux (RHEL)? stack.watch will email you.
