CVE-2026-97024

HighCVSS 7.1/10Last modified Sep 29, 2026

Description

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-61

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-970253.2Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowi CVE-2026-970263.9Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems wi CVE-2026-970273.6Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service CVE-2026-970295.7Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching proces CVE-2026-97037.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only th CVE-2026-970306.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped CVE-2026-970317.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could t CVE-2026-970327.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies CVE-2026-97048.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token CVE-2026-97056.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT CVE-2026-970558.1SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or CVE-2026-970566.8SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the defa