Read the docs
TI-2026-63872 Aliases CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to…

Priority LOW 33CWE-61Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 14 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix Partial Flatpak (Flatpak): 1.18.1Red Hat: 8 advisoriesRed Hat: 14 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flatpakFlatpakbefore 1.18.11.18.1Patch availableCNA
  • Flatpak Vendorflatpak Affected before 1.18.1 Fixed in 1.18.1 Patch available CNA

Remediation

  • Fix · CNA Flatpak (Flatpak) Fixed in 1.18.1

Red Hat 8 advisories

  • RHSA-2026:95493 Released 2026-11-05 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) flatpak-1.12.9-1.el8_6.1, flatpak-libs-1.12.9-1.el8_6.1, flatpak-selinux-1.12.9-1.el8_6.1 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) flatpak-1.12.9-1.el8_6.1, flatpak-libs-1.12.9-1.el8_6.1, flatpak-selinux-1.12.9-1.el8_6.1 +1
  • RHSA-2026:92221 Released 2026-11-02 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) flatpak-1.16.0-5.el10_0.6, flatpak-libs-1.16.0-5.el10_0.6, flatpak-selinux-1.16.0-5.el10_0.6 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) flatpak-devel-1.16.0-5.el10_0.6
  • RHSA-2026:92369 Released 2026-10-29 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) flatpak-1.12.7-5.el9_2.5, flatpak-libs-1.12.7-5.el9_2.5, flatpak-selinux-1.12.7-5.el9_2.5 +1
Show 5 more Red Hat advisories
  • RHSA-2026:90364 Released 2026-10-26 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) flatpak-1.12.9-3.el9_4.5, flatpak-libs-1.12.9-3.el9_4.5, flatpak-selinux-1.12.9-3.el9_4.5 +1
  • RHSA-2026:89733 Released 2026-10-26 · Red Hat rating Important
    flatpak security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) flatpak-1.12.9-4.el9_6.5, flatpak-devel-1.12.9-4.el9_6.5, flatpak-session-helper-1.12.9-4.el9_6.5
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) flatpak-1.12.9-4.el9_6.5, flatpak-libs-1.12.9-4.el9_6.5, flatpak-selinux-1.12.9-4.el9_6.5 +1
  • RHSA-2026:80687 Released 2026-10-12 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 8) flatpak-1.12.9-7.el8_10, flatpak-libs-1.12.9-7.el8_10, flatpak-selinux-1.12.9-7.el8_10 +1
    • Red Hat Enterprise Linux CRB (v. 8) flatpak-1.12.9-7.el8_10, flatpak-devel-1.12.9-7.el8_10, flatpak-session-helper-1.12.9-7.el8_10
  • RHSA-2026:80497 Released 2026-10-12 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 9) flatpak-1.12.9-4.el9_8.4, flatpak-libs-1.12.9-4.el9_8.4, flatpak-selinux-1.12.9-4.el9_8.4 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) flatpak-1.12.9-4.el9_8.4, flatpak-devel-1.12.9-4.el9_8.4, flatpak-session-helper-1.12.9-4.el9_8.4
  • RHSA-2026:80498 Released 2026-10-12 · Red Hat rating Important
    flatpak security update
    • Red Hat Enterprise Linux AppStream (v. 10) flatpak-1.16.0-9.el10_2.4, flatpak-libs-1.16.0-9.el10_2.4, flatpak-selinux-1.16.0-9.el10_2.4 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) flatpak-devel-1.16.0-9.el10_2.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Flatpak 1.18.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-63871 In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so…Priority LOW 18
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:89733
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:80498
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:80687
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:80497
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:95493
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:92369
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:90364
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:92221
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:89733
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:95493
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:80687
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:80498
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:80497
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:92221

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-96808
  2. 2026-10-12 Fix available: RHSA-2026:80498 · Red Hat
  3. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80497 · Red Hat
  5. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
  6. 2026-10-12 Fix available: RHSA-2026:80687 · Red Hat
  7. 2026-10-13 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
  8. 2026-10-26 Fix available: RHSA-2026:89733 · Red Hat
  9. 2026-10-26 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
  10. 2026-10-27 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
  11. 2026-10-29 Fix available: RHSA-2026:90364 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:92369 · Red Hat
  13. 2026-10-30 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat
  14. 2026-11-02 Fix available: RHSA-2026:92221 · Red Hat
  15. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · Red Hat
  16. 2026-11-05 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · Red Hat
  17. 2026-11-06 Fix available: RHSA-2026:95493 · Red Hat

References

Other 1

  • TI-2026-28833 flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files CVSS 4.0HIGH 7.1
  • TI-2026-26401 Flatpak has a complete sandbox escape leading to host file access and code execution in the host context CVSS 4.0CRITICAL 9.3
  • TI-2024-28440 Flatpak may allow access to files outside sandbox for certain apps CVSS 3.1CRITICAL 10.0
  • TI-2023-12679 TIOCLINUX can send commands outside sandbox if running on a virtual console CVSS 3.1CRITICAL 10.0
  • TI-2026-79756 Path traversal in XDG Desktop Portal allows arbitrary file access CVSS 4.0HIGH 8.8
  • TI-2026-26402 Flatpak affected by arbitrary file deletion on the host filesystem CVSS 4.0HIGH 8.7
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences