Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related info
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
Security Fix(es):
* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.
Moderate: flatpak security, bug fix, and enhancement update
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
The following packages have been upgraded to a later upstream version: flatpak (1.10.8). (BZ#2222103)
Security Fix(es):
* flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)
* flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Permissions granted to applications can be hidden from the user at install time (CVE-2021-43860)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Flatpak is a system for building, distributing, and running sandboxed
desktop applications on Linux.
Bug Fix(es) and Enhancement(s):
* CVE-2021-41133 flatpak: sandbox bypass via recent VFS-manipulating
syscalls (BZ#2012868)
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.