CVE-2026-96807
Summary
| CVE | CVE-2026-96807 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-23 17:17:25 UTC |
| Updated | 2026-09-24 21:00:46 UTC |
| Description | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit. |
Risk And Classification
Primary CVSS: v3.1 4 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Problem Types: CWE-61 | CWE-61 CWE-61 UNIX Symbolic Link (Symlink) Following
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
| 3.1 | CNA | CVSS | 4 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The issue has been fixed in version 1.18.1 by commits: * e13dfed https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c "common: Fix return value and typos in flatpak_switch_symlink_and_remove" * f6c8fb5 https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55 "common: Use fd-based operations in flatpak_switch_symlink_and_remove" * 76c9296 https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592 "run: Harden regenerate_ld_cache against symlink attacks" For LTS operating system distributions, backports of these changes are available in the flatpak-1.16.x branch. Please note that cherry-picked libglnx changes "chase: Add internal glnx_chaseat_full for a strategic callback" and "chase: Add glnx_chase_and_mkdirat" are also required.