CVE-2026-96282 Flatpak: flatpak: extension metadata path traversal file existence oracle
A malicious Flatpak extension can probe host filesystem paths and disclose directory listings to sandboxed applications, bypassing sandbox isolation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-96282?
CVE-2026-96282 is a low-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 27 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Weakness: CWE-59
Which versions are affected by CVE-2026-96282?
How do I fix CVE-2026-96282?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-96282 being exploited?
There is no known exploitation of CVE-2026-96282 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-96282, UBUNTU-CVE-2026-96282.