CVE-2026-96276
📛 CVE Title
Flatpak: flatpak: arbitrary write in host context via flatpak build-init
Description
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- redhat
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 9.8 / 10 CRITICAL source: NVD
- CWE(s)
-
CWE-22 - Reserved
- 2026-09-22
- Published
- 2026-09-23 15:01 UTC
- Last updated
- 2026-09-23 15:28 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96276.json
- Linked Threat
- CVE-2026-96276 — Flatpak: flatpak: arbitrary write in host context via flatpak build-init
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 15:17:32 UTC
- NVD last modified
- 2026-09-23 19:40:10 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
NVD / KEV / EPSS data refreshed 2026-09-24 04:26 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85343 - Assigner
- redhat
- Published
- Sep 23, 2026, 3:01:49 PM
- Updated
- Sep 23, 2026, 3:28:23 PM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.0000
ENISA description: If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
Affected products (4)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
- https://access.redhat.com/security/cve/CVE-2026-96276 vdb-entryx_refsource_REDHAT
- RHBZ#2539418 issue-trackingx_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://access.redhat.com/security/cve/CVE-2026-96276 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2539418 secalert@redhat.com
- https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm secalert@redhat.com
Remediations (20)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
A malicious SDK container can declare an extension point with a crafted directory path. When a developer runs flatpak build-init with the --writable-sdk and --sdk-extension flags, the path‑resolution function does not sanitize the input and allows .. traversal, enabling attacker‑chosen files to be written outside the working directory. This flaw permits arbitrary file writes in the host ...
2026-09-24 11:44 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-24 11:44 UTC -
web:security-tracker.debian.org
Vulnerable and fixed packages The table below lists information on source packages.
2026-09-24 11:44 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:44 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-24 11:44 UTC -
web:support.sap.com
SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 9th of June 2026 , SAP security patch day saw the release of 15 new security notes.
2026-09-24 11:44 UTC -
web:www.crowdstrike.com
Microsoft patches 206 vulnerabilities in June 2026 Patch Tuesday, including three publicly disclosed zero-days.
2026-09-24 11:44 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-24 11:44 UTC -
web:www.oracle.com
Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...
2026-09-24 11:44 UTC -
web:www.suse.com
Secure your Linux systems from CVE - 2026 -6276. Stay ahead of potential threats with the latest security updates from SUSE.
2026-09-24 11:44 UTC -
web:cybersecuritynews.com
Microsoft released its September 2026 Patch Tuesday security updates on September 8, addressing 973 vulnerabilities, including two zero-days already exploited in attacks.
2026-09-25 10:08 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-09-25 10:08 UTC -
web:support.microsoft.com
This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5120994) includes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To ...
2026-09-25 10:08 UTC -
web:windowsreport.com
Microsoft's September 2026 Patch Tuesday fixes a record 966 security vulnerabilities, including two zero-days that attackers are actively exploiting. Microsoft has released Patch Tuesday updates for Windows 11 alongside Windows 10 KB5122878, delivering what appears to be the company's largest ...
2026-09-25 10:08 UTC -
web:www.action1.com
In this issue: September 2026 Patch Tuesday updates from Microsoft, featuring zero-day vulnerabilities and critical security flaws.
2026-09-25 10:08 UTC -
web:www.automox.com
September 2026 Patch Tuesday ships a record 973 CVEs , led by two exploited elevation of privilege bugs in the Windows Update Stack and ALPC. Plus unauthenticated RCE in DNS and Remote Desktop Services, a SQL Copilot read-only bypass, and an Outlook Reading Pane RCE.
2026-09-25 10:08 UTC -
web:www.it-connect.tech
Fix the September 2026 RDS bug on Windows Server with Microsoft's KIR rollback. Learn deployment steps and keep the security update installed.
2026-09-25 10:08 UTC -
web:www.linkedin.com
Microsoft has released its largest Patch Tuesday security update to date, addressing over 900 vulnerabilities across Windows and other products, including two privilege-escalation flaws that ...
2026-09-25 10:08 UTC -
web:www.oracle.com
Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor
2026-09-25 10:08 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-09-25 10:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-96276.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-96276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:28:10.393280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:28:23.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "flatpak",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "flatpak",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "flatpak",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "flatpak",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Upstream acknowledges Sebastian Wick as the original reporter."
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:01:49.657Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-96276"
},
{
"name": "RHBZ#2539418",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539418"
},
{
"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-11T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Flatpak: flatpak: arbitrary write in host context via flatpak build-init",
"workarounds": [
{
"lang": "en",
"value": "Fixed in v1.18.1. Avoid using an non-trusted SDK for development/compilation."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-96276",
"datePublished": "2026-09-23T15:01:49.657Z",
"dateReserved": "2026-09-22T20:42:35.875Z",
"dateUpdated": "2026-09-23T15:28:23.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}