MinorCritical vulnerability
CVE-2026-97024 (CVSS 7.1)
NVD · officialPublished Sep 29, 2026Risk 23/100
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
Technical details
CVSS
7.1
AV:NetworkAC:LowPR:NoneUI:RequiredC:NoneI:LowA:High
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source