Search: CVE-2026-96276

CVE-2026-96276 is a vulnerability in Red Hat Enterprise Linux 10 involving improper limitation of a pathname to a restricted directory during the use of flatpak build-init with a writable SDK and SDK extension. A malicious SDK container can specify a crafted directory path containing '..' traversal sequences, allowing files to be written outside the intended working directory. Exploitation requires a developer to build against an untrusted SDK container, resulting in arbitrary file overwrite within the developer's filesystem permissions.