This vulnerability involves Flatpak's export/bin directory handling during app deployment, allowing a malicious Flatpak application to perform path traversal and delete arbitrary files outside the intended deployment directory. When Flatpak apps are installed or upgraded system-wide on Red Hat Enterprise Linux 10, the deletion is executed with root privileges, increasing the severity of the impact. The vulnerability is tracked as CVE-2026-97023 with a CVSS v3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). Red Hat's advisory recommends avoiding installation of Flatpak apps from untrusted publishers, especially in system-wide deployments. No explicit patch or fix release date is provided in the advisory.

The vulnerability allows a malicious Flatpak app to delete attacker-chosen files outside the deployment directory during installation or upgrade. In system-wide installations, this deletion is performed with root privileges, resulting in a high impact on system availability. There is no confidentiality impact, and integrity impact is low. Exploitation requires user interaction but no privileges.

Red Hat's advisory recommends avoiding installing Flatpak apps from non-trusted publishers, particularly in system-wide deployments. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance. No official fix or patch is explicitly stated in the advisory at this time.