CVE-2026-96279
Description
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.
Statement
Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
The malicious archive is served over the network (AV:N), and the attacker needs no privileges of their own on the victim system (PR:N). Once the client pulls the crafted layer archive, exploitation is deterministic: Flatpak's OCI extraction rebases archive entry pathnames to the destination directory and enforces ARCHIVE_EXTRACT_SECURE_NODOTDOT to reject .. in pathnames and hardlink targets, but it fails to rebase the hardlink target itself, so a crafted entry with an absolute hardlink target (e.g. /etc/shadow) causes libarchive to hardlink that host file directly into the extraction directory (AC:L). Meaningful user interaction is required (UI:R).
On system-wide installs, this extraction runs via the privileged system-helper as root, so the hardlinked file can be an arbitrary root-owned file the attacker has no other means to access. The vulnerable and impacted components remain within the same overall flatpak client/helper security authority that already operates with root privileges for system installs by design (S:U). Because Flatpak app content is deployed with permissions intended to be readable by the installing/running user, once the sensitive file is hardlinked into the app's deployed tree its contents become readable to any local user who can run or inspect the app (C:H). The flaw is a read-only primitive: it does not modify any file content (I:N) and does not disrupt service (A:N).
Mitigation
Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Acknowledgements
Upstream acknowledges Sebastian Wick as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
