CVE-2026-97023: Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/flatpakto a version that resolves this vulnerability.Fixed in 1.16.6-1~deb13u3Fixed in 1.18.4-1 - Upgrade
Upgrade
debian/flatpakto a version that resolves this vulnerability.Fixed in 1.16.6-1~deb13u3 - Upgrade
Upgrade
debian/flatpakto a version that resolves this vulnerability.Fixed in 1.18.4-1
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Systems that install or upgrade malicious Flatpak apps are exposed. System-wide Flatpak installations are especially impacted because the affected deletion operation runs as root.
What must an attacker do to exploit it?
An attacker must provide a malicious Flatpak app containing path traversal in its export/bin deployment content. Exploitation occurs when that app is installed or upgraded, so user interaction is required.
What is the impact of a successful exploit?
A malicious app can cause deletion of attacker-chosen files outside its intended deployment directory. In a system-wide installation, those deletions are performed with root privileges.