{"id":"ALSA-2026:80687","summary":"Important: flatpak security update","details":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n  * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n  * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n  * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-10-12T15:00:03.733005760Z","published":"2026-10-12T00:00:00Z","related":["CVE-2026-90616","CVE-2026-96275","CVE-2026-96280","CVE-2026-96808"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:80687"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-90616"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-96275"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-96280"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-96808"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2532613"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2539416"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2539419"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2539569"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-80687.html"}],"affected":[{"package":{"name":"flatpak","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/flatpak"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:80687.json"}},{"package":{"name":"flatpak-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/flatpak-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:80687.json"}},{"package":{"name":"flatpak-libs","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/flatpak-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:80687.json"}},{"package":{"name":"flatpak-selinux","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/flatpak-selinux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:80687.json"}},{"package":{"name":"flatpak-session-helper","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/flatpak-session-helper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:80687.json"}}],"schema_version":"1.9.0"}