| Name | CVE-2026-96282 |
| Description | A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6432-1 |
| Debian Bugs | 1144130 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| flatpak (PTS) | bookworm, bookworm (security) | 1.14.10-1~deb12u2 | vulnerable |
| trixie | 1.16.6-1~deb13u2 | fixed | |
| trixie (security) | 1.16.6-1~deb13u3 | fixed | |
| forky, sid | 1.18.4-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| flatpak | source | trixie | 1.16.6-1~deb13u2 | DSA-6432-1 | ||
| flatpak | source | (unstable) | 1.18.1-1 | 1144130 |
https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
Fixed by: https://github.com/flatpak/flatpak/commit/6ec728c15b4eff47b7d69a2cc22e4aef52011585 (1.18.1)
Fixed by: https://github.com/flatpak/flatpak/commit/ad044fc728cffe22dfa78e14c351bfe907f5164f (1.18.1)
Fixed by: https://github.com/flatpak/flatpak/commit/2764862569886360a550491ecd06c89e1b76eb8e (branch flatpak-1.16.x)
Fixed by: https://github.com/flatpak/flatpak/commit/e1f2ef83cd7225906078635e3d7561e9bc2cbd5b (branch flatpak-1.16.x)
Additional requirement: https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1 (branch flatpak-1.16.x)
Additional requirement: https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1 (branch flatpak-1.16.x)