CVE-2026-97023
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
CVSS Score
7.1
EPSS Score
0.5%
EPSS Percentile
40th
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
| CWE | CWE-61 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Sep 28, 2026 |
| Last Updated | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new high vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89849 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89850 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89859 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95061 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95062 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95063 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:98490 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:98595 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-97023 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2542606 github.com: https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
Credits
Red Hat would like to thank Sebastian Wick for reporting this issue.