CVE-2026-96808

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker could tamper with ostree commit objects, leading to root-controlled file writes and local root privilege escalation.

This vulnerability is rated as Important severity because an authenticated local user can abuse the D-Bus system helper to bypass file validation and achieve elevated root privileges on the host system. While exploitation demands an active interactive session and specific timing to manipulate filesystem endpoints, the blast radius allows complete host compromise without prior administrative credentials. Workstation environments providing Flatpak for application delivery are primarily exposed, whereas typical minimal server deployments lacking desktop packages do not run the affected helper service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.