CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.

Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

The malicious archive is served over the network (AV:N), and the attacker needs no privileges of their own on the victim system (PR:N). Once the client pulls the crafted layer archive, exploitation is deterministic: Flatpak's OCI extraction rebases archive entry pathnames to the destination directory and enforces ARCHIVE_EXTRACT_SECURE_NODOTDOT to reject .. in pathnames and hardlink targets, but it fails to rebase the hardlink target itself, so a crafted entry with an absolute hardlink target (e.g. /etc/shadow) causes libarchive to hardlink that host file directly into the extraction directory (AC:L). Meaningful user interaction is required (UI:R).

On system-wide installs, this extraction runs via the privileged system-helper as root, so the hardlinked file can be an arbitrary root-owned file the attacker has no other means to access. The vulnerable and impacted components remain within the same overall flatpak client/helper security authority that already operates with root privileges for system installs by design (S:U). Because Flatpak app content is deployed with permissions intended to be readable by the installing/running user, once the sensitive file is hardlinked into the app's deployed tree its contents become readable to any local user who can run or inspect the app (C:H). The flaw is a read-only primitive: it does not modify any file content (I:N) and does not disrupt service (A:N).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected.