ALSA-2026:89859: Important: flatpak security update

Q: What level of access could an attacker obtain through these flaws?

The reported impacts are arbitrary file deletion and arbitrary file write in a root context. The affected paths are the deploy directory export/bin path for deletion and files/etc for writing.

Q: Which installed components are covered by this update?

The advisory lists almalinux/flatpak, almalinux/flatpak-devel, almalinux/flatpak-libs, almalinux/flatpak-selinux, and almalinux/flatpak-session-helper.

Published Oct 26, 2026

Updated

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

5 affected componentsFixes available

almalinux/flatpak<1.12.9-9.el8_10

1.12.9-9.el8_10

almalinux/flatpak-devel<1.12.9-9.el8_10

1.12.9-9.el8_10

almalinux/flatpak-libs<1.12.9-9.el8_10

1.12.9-9.el8_10

almalinux/flatpak-selinux<1.12.9-9.el8_10

1.12.9-9.el8_10

almalinux/flatpak-session-helper<1.12.9-9.el8_10

1.12.9-9.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/flatpak to a version that resolves this vulnerability.
Fixed in 1.12.9-9.el8_10
Upgrade
Upgrade almalinux/flatpak-devel to a version that resolves this vulnerability.
Fixed in 1.12.9-9.el8_10
Upgrade
Upgrade almalinux/flatpak-libs to a version that resolves this vulnerability.
Fixed in 1.12.9-9.el8_10
Upgrade
Upgrade almalinux/flatpak-selinux to a version that resolves this vulnerability.
Fixed in 1.12.9-9.el8_10
Upgrade
Upgrade almalinux/flatpak-session-helper to a version that resolves this vulnerability.
Fixed in 1.12.9-9.el8_10

Event History

Oct 26, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What level of access could an attacker obtain through these flaws?

The reported impacts are arbitrary file deletion and arbitrary file write in a root context. The affected paths are the deploy directory export/bin path for deletion and files/etc for writing.

Which installed components are covered by this update?

The advisory lists almalinux/flatpak, almalinux/flatpak-devel, almalinux/flatpak-libs, almalinux/flatpak-selinux, and almalinux/flatpak-session-helper.

ALSA-2026:89859: Important: flatpak security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access could an attacker obtain through these flaws?

Which installed components are covered by this update?

Company

Resources

Contact

Frequently Asked Questions

What level of access could an attacker obtain through these flaws?

Which installed components are covered by this update?