CVE-2026-97024 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
A malicious Flatpak app can exploit path traversal to overwrite critical system files as root during installation, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-97024?
CVE-2026-97024 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
Weakness: CWE-61
Which versions are affected by CVE-2026-97024?
How do I fix CVE-2026-97024?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-97024 being exploited?
There is no known exploitation of CVE-2026-97024 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-97024, UBUNTU-CVE-2026-97024.