CVE-2026-96282 — Flatpak: flatpak: extension metadata path traversal file existence oracle
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to san…
Published: 2026-09-27 · CVSS: 3.1 · CVSS 3.1
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7