Homepage

Directory Traversal Affecting flatpak package, versions <1.18.1-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.17% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-FLATPAK-20046932
  • published23 Sept 2026
  • disclosed20 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Sep 2026

NewCVE-2026-92162  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Debian:unstable flatpak to version 1.18.1-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream flatpak package and not the flatpak package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the flatpak-system-helper process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned lock file and icons directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.