CVE-2026-97023: Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
Affected Software
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Systems that install or upgrade malicious Flatpak apps are exposed. System-wide Flatpak installations are especially impacted because the affected deletion operation runs as root.
What must an attacker do to exploit it?
An attacker must provide a malicious Flatpak app containing path traversal in its export/bin deployment content. Exploitation occurs when that app is installed or upgraded, so user interaction is required.
What is the impact of a successful exploit?
A malicious app can cause deletion of attacker-chosen files outside its intended deployment directory. In a system-wide installation, those deletions are performed with root privileges.