CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows .. traversal.

Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

Exploitation requires a developer to build against a malicious or compromised SDK container using flatpak build-init --writable-sdk --sdk-extension. The SDK content is retrieved from a remote registry, so no local access to the victim's system is required by the attacker (AV:N), and the attacker needs no privileges of their own (PR:N). Once the developer builds against the malicious SDK, exploitation is deterministic: the extension point's directory field is resolved via g_file_resolve_relative_path, which does not reject .. components, allowing a crafted value such as directory=../../<path> to redirect the copy operation outside the build tree (AC:L). Meaningful user interaction is required, as the developer must actively choose to build against the untrusted SDK (UI:R).

flatpak build-init runs entirely with the invoking developer's own privileges, so the impact is bounded by that user's existing filesystem access and no privilege boundary is crossed (S:U). The flatpak_rm_rf cleanup of the traversed target path allows arbitrary files reachable by the developer's account to be deleted and replaced with attacker-controlled content, constituting a full integrity compromise of that data (I:H). There is no confidentiality impact, as the flaw provides no read primitive (C:N). The impact is scoped to a specific, attacker-chosen target path rather than broad service disruption, so it is not scored as an availability impact (A:N).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using an non-trusted SDK for development/compilation.