{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.0-9.el10_2.4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-7.el8_10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-4.el9_8.4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.7-5.el9_2.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-3.el9_4.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-4.el9_6.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-96275","cwes":["CWE-22"],"description":"A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.","epss":{"date":"2026-11-01","percentile":0.46476,"score":0.00557},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793608400474,"publishedAt":1790175698344,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80497"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80498"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80687"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:89733"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:90364"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:92369"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-96275"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539416"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Avoid installing Flatpak extensions from non-trusted sources."}],"revision":"787325e8c1548baf821b0b253df52878cb00c78b12ecb018415b073588445092","sources":[{"modifiedAt":1793608400474,"name":"CNA: redhat","retrievedAt":1793610526614,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96275"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793610530295,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96275"}],"ssvc":{"assessedAt":1790359749886,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Flatpak: flatpak: arbitrary write access as root via extra-data extraction","updatedAt":1793610530295}