CVE-2026-96284: Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.
Other sources
GHSA-2fxp-43j9-pwvc (https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc)
Description: The OCI code paths in the system helper will follow symlinks when importing OCI images which are under the user's control, allowing a malicious user to get read-access to files in the system-helper context if a system OCI repository is configured.
Mitigation: Remove all OCI system remotes. Patched in 1.16.4 and 1.18.0. Credit: @smcv.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.16.4 - Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.0 - Remove
Remove
OCI system remotesfrom your environment.Remove all OCI system remotes.
Event History
Frequently Asked Questions
Which installations are exposed?
Installations are exposed only if a system OCI repository (system OCI remote) is configured. The issue involves OCI images under a malicious user's control being imported through the system helper.
What access does an attacker need?
An attacker needs local access with low privileges and the ability to provide or control an OCI image that the system helper imports. No user interaction is required.
What can be done if updates cannot be installed immediately?
Remove all OCI system remotes. This mitigates the vulnerable OCI import path in the system helper.
Which versions contain fixes?
The issue is patched in Flatpak 1.16.4 and 1.18.0.