Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

Description

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

Affected Products

Vendor	Product	Versions
red hat	red hat enterprise linux	—

References

https://access.redhat.com/security/cve/CVE-2026-96284(vdb-entry, x_refsource_REDHAT)
https://bugzilla.redhat.com/show_bug.cgi?id=2539423(issue-tracking, x_refsource_REDHAT)
https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc

Related News (1 articles)

Tier C

VulDB3h ago

CVE-2026-96284 | Red Hat Enterprise Linux 7/8/9/10 OCI Code Paths path traversal

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.12.5 LOW

VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA KEV❌ No

Actively exploited✅ Yes

CWECWE-59

PublishedSep 27, 2026

Last enriched2h ago

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-96280EXP

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

Trending: 46

MEDIUMCVE-2026-96281EXP

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

Trending: 42

NONECVE-2026-97185EXP

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

Trending: 36

NONECVE-2026-88924EXP

Gvfs: gvfs-admin socket ownership race permits local root

Trending: 36

NONECVE-2026-96546EXP

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

Trending: 34

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Sep 27, 2026

Discovered by ZDM

Sep 27, 2026

Actively Exploited

Sep 27, 2026

Exploit Available

Sep 27, 2026