A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause… (CVE-2026-97024)

CVE-2026-97024 is a path traversal vulnerability in Flatpak that affects the handling of the files/etc directory during application deployment. A malicious Flatpak app can exploit this flaw to cause certain host system files—like passwd, group, machine-id, or resolv.conf—to be emptied or replaced with symbolic links. This occurs when the app is installed or upgraded. On system-wide installations, these file modifications are performed with root privileges, increasing the potential impact. The vulnerability has a CVSS 3.1 score of 7.1, indicating a medium severity level. Multiple specific Flatpak versions are affected, as enumerated in the provided affectedVersions list.

Exploitation of this vulnerability allows a malicious Flatpak app to modify or empty critical system files on the host, potentially disrupting system functionality or security. Because system-wide installations perform these writes as root, the impact includes the risk of privilege escalation or denial of service by corrupting essential configuration files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid installing or upgrading untrusted Flatpak applications, especially in system-wide installations. Monitor vendor channels for updates addressing this vulnerability.