CVE-2026-97024
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
CVSS Score
7.1
EPSS Score
0.5%
EPSS Percentile
41th
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
| CWE | CWE-61 |
| Vendor | red hat |
| Product | red hat enterprise linux 10 |
| Published | Sep 29, 2026 |
| Last Updated | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 10
Be the first to know when new high vulnerabilities affecting red hat red hat enterprise linux 10 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10
All versions affected Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89849 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89850 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:89859 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95061 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95062 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95063 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:95064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:98490 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:98595 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-97024 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2542625 github.com: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
Credits
Red Hat would like to thank Sebastian Wick for reporting this issue.