CVE-2026-96807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96807", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-23T16:54:16.535Z", "datePublished": "2026-09-23T16:54:16.931Z", "dateUpdated": "2026-09-26T22:51:21.873Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Flatpak", "programFiles": ["common/flatpak-run.c"], "programRoutines": [{"name": "regenerate_ld_cache"}], "repo": "https://github.com/flatpak/flatpak", "vendor": "Flatpak", "versions": [{"lessThan": "1.18.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-61", "description": "CWE-61 UNIX Symbolic Link (Symlink) Following", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-23T16:54:16.931Z"}, "references": [{"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The issue has been fixed in version 1.18.1 by commits:</p>\n<ul>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c\">e13dfed</a> \"common: Fix return value and typos in flatpak_switch_symlink_and_remove\"</li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55\">f6c8fb5</a> \"common: Use fd-based operations in flatpak_switch_symlink_and_remove\"</li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592\">76c9296</a> \"run: Harden regenerate_ld_cache against symlink attacks\"</li>\n</ul>\n<p>For LTS operating system distributions, backports of these changes are available in the <code>flatpak-1.16.x</code>\n branch. Please note that cherry-picked libglnx changes \"chase: Add \ninternal glnx_chaseat_full for a strategic callback\" and \"chase: Add \nglnx_chase_and_mkdirat\" are also required.</p>"}], "value": "The issue has been fixed in version 1.18.1 by commits:\n\n\n\n * e13dfed https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c \"common: Fix return value and typos in flatpak_switch_symlink_and_remove\"\n\n * f6c8fb5 https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55 \"common: Use fd-based operations in flatpak_switch_symlink_and_remove\"\n\n * 76c9296 https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592 \"run: Harden regenerate_ld_cache against symlink attacks\"\n\n\n\n\nFor LTS operating system distributions, backports of these changes are available in the flatpak-1.16.x\n branch. Please note that cherry-picked libglnx changes \"chase: Add \ninternal glnx_chaseat_full for a strategic callback\" and \"chase: Add \nglnx_chase_and_mkdirat\" are also required."}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T22:45:37.260895Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T22:51:21.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-26T22:45:37.260895Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T22:49:06.208Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/flatpak/flatpak", "vendor": "Flatpak", "product": "Flatpak", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.1", "versionType": "semver"}], "platforms": ["Linux"], "programFiles": ["common/flatpak-run.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "regenerate_ld_cache"}]}], "solutions": [{"lang": "en", "value": "The issue has been fixed in version 1.18.1 by commits:\n\n\n\n * e13dfed https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c \"common: Fix return value and typos in flatpak_switch_symlink_and_remove\"\n\n * f6c8fb5 https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55 \"common: Use fd-based operations in flatpak_switch_symlink_and_remove\"\n\n * 76c9296 https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592 \"run: Harden regenerate_ld_cache against symlink attacks\"\n\n\n\n\nFor LTS operating system distributions, backports of these changes are available in the flatpak-1.16.x\n branch. Please note that cherry-picked libglnx changes \"chase: Add \ninternal glnx_chaseat_full for a strategic callback\" and \"chase: Add \nglnx_chase_and_mkdirat\" are also required.", "supportingMedia": [{"type": "text/html", "value": "<p>The issue has been fixed in version 1.18.1 by commits:</p>\n<ul>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c\">e13dfed</a> \"common: Fix return value and typos in flatpak_switch_symlink_and_remove\"</li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55\">f6c8fb5</a> \"common: Use fd-based operations in flatpak_switch_symlink_and_remove\"</li>\n<li><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592\">76c9296</a> \"run: Harden regenerate_ld_cache against symlink attacks\"</li>\n</ul>\n<p>For LTS operating system distributions, backports of these changes are available in the <code>flatpak-1.16.x</code>\n branch. Please note that cherry-picked libglnx changes \"chase: Add \ninternal glnx_chaseat_full for a strategic callback\" and \"chase: Add \nglnx_chase_and_mkdirat\" are also required.</p>", "base64": false}]}], "references": [{"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-61", "description": "CWE-61 UNIX Symbolic Link (Symlink) Following"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-23T16:54:16.931Z"}}}, "cveMetadata": {"cveId": "CVE-2026-96807", "state": "PUBLISHED", "dateUpdated": "2026-09-26T22:51:21.873Z", "dateReserved": "2026-09-23T16:54:16.535Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-23T16:54:16.931Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Flatpak", "programFiles": ["common/flatpak-run.c"], "programRoutines": [{"name": "regenerate_ld_cache"}], "repo": "https://github.com/flatpak/flatpak", "vendor": "Flatpak", "versions": [{"lessThan": "1.18.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit."}], "id": "CVE-2026-96807", "lastModified": "2026-09-26T23:16:42.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 2.5, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96807", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-26T22:45:37.260895Z", "version": "2.0.3"}}]}, "published": "2026-09-23T17:17:25.703", "references": [{"source": "cve@mitre.org", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-61"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "flatpak: Flatpak: Low integrity or availability impact via symlink manipulation", "id": "2539543", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539543"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Flatpak. A malicious sandboxed application can manipulate a symlink, causing the `regenerate_ld_cache` function to write files to an unintended location. While the attacker cannot control the content or filenames, this vulnerability could lead to a low impact on system integrity or availability."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-96807", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "flatpak", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "flatpak", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "flatpak", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-23T16:54:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96807\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96807\nhttps://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Flatpak", "source": "cna", "vendor": "Flatpak"}, "product": "flatpak", "vendor": "flatpak"}], "created": "2026-09-23T18:30:06.967513+00:00", "updated": "2026-09-24T04:00:13.035299+00:00", "vendors": ["flatpak", "flatpak$PRODUCT$flatpak"]}