CVE-2026-96284 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
A malicious user can read arbitrary files in the system-helper context by exploiting symlink following during OCI image imports if a system OCI repository is configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96284?
CVE-2026-96284 is a low-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 27 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
Weakness: CWE-59
Which versions are affected by CVE-2026-96284?
How do I fix CVE-2026-96284?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-96284 being exploited?
There is no known exploitation of CVE-2026-96284 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-96284, UBUNTU-CVE-2026-96284.