A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause… (CVE-2026-97023)

CVE-2026-97023 describes a path traversal vulnerability in Flatpak's handling of the export/bin directory during application deployment. This flaw enables a malicious Flatpak application to delete arbitrary files outside the intended deployment directory when the app is installed or upgraded. On systems with system-wide Flatpak installations, the deletion is executed with root privileges, increasing the potential impact. The vulnerability affects numerous specific Flatpak versions as listed, and the CVSS 3.1 base score is 7.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

The vulnerability allows an attacker who can install or upgrade a malicious Flatpak app to delete files outside the deployment directory, potentially causing denial of service or disruption by removing critical files. In system-wide installations, the deletion occurs with root privileges, which could lead to significant system impact. There is no confidentiality impact reported, but integrity and availability are affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Flatpak app installation and upgrades to trusted sources only and avoid installing untrusted Flatpak applications, especially on systems with system-wide installations.