CVE-2026-96276: Flatpak build-init Path Traversal Enables Arbitrary File Writes

Executive Summary

CVE-2026-96276 is a path traversal vulnerability (CWE-22) in Flatpak, the Linux application sandboxing and distribution framework, carrying a CVSS score of 9.8 (Critical) per NVD and Red Hat's scoring. It was published 2026-09-23 and affects the flatpak build-init command when invoked with SDK extension handling.

flatpak build-init --writable-sdk --sdk-extension is a normal part of the Flatpak build workflow: it sets up a writable build sandbox and copies files from a named SDK extension into that sandbox so a developer can build against it. The problem is in how the target location for those copied files is computed. Extension points can declare a directory key in their metadata telling Flatpak where inside the build tree to place the extension's files. In vulnerable versions, that path is resolved with g_file_resolve_relative_path, a GLib function that happily resolves .. components. A malicious or compromised SDK container can therefore declare an extension point with a directory value such as ../../some/host/path, and when a developer runs build-init against that SDK, Flatpak writes the attacker's files at that resolved — and unintended — location instead of confining them to the build directory.

It gets worse before it gets better: Flatpak cleans the destination path with flatpak_rm_rf before copying the extension's content into it. That means the traversal doesn't just add attacker-controlled files somewhere unexpected — it first deletes whatever already exists at the traversed path, then replaces it with attacker-supplied content. On a developer workstation or CI build agent, that combination (delete-then-write, attacker-controlled destination) is a path to configuration tampering, dotfile/profile poisoning, or planting executable content somewhere it will later run.

The fix (Flatpak 1.18.1, with a backport for the flatpak-1.16.x LTS branch) reworks the copy path to use fd-relative operations that cannot escape the intended directory, rather than resolving a string path that can contain .. segments.

Vulnerability Overview

Affected Versions

We could not verify an exact affected-version floor (e.g., "1.x and later") from NVD, the GitHub advisory, or Red Hat's bug tracker as of this writing. Treat "any version older than 1.18.1, or the flatpak-1.16.x branch prior to its patch commits" as the safe working assumption.

Attack Vector

1. Attacker publishes or compromises a Flatpak SDK container (e.g. a
   community/unofficial SDK remote, or a legitimate SDK repo that has
   been tampered with).
 
2. The malicious SDK declares an extension point in its metadata whose
   "directory" key is set to a traversal path instead of a normal
   in-tree relative path — for example, something equivalent to
   "../../.config/some-target" rather than "files/target".
 
3. A developer (or a CI/build pipeline) adds that SDK as a remote and
   runs:
       flatpak build-init --writable-sdk --sdk-extension=org.example.MaliciousSdk ...
   (or the equivalent --base-extensions invocation) to set up a build
   sandbox against it.
 
4. build-init resolves the extension point's "directory" value with
   g_file_resolve_relative_path, which honors ".." segments instead of
   confining the result to the build tree.
 
5. Before copying the extension's files in, Flatpak cleans the
   resolved destination with flatpak_rm_rf — deleting whatever already
   exists there.
 
6. Flatpak then copies the extension's attacker-controlled files into
   that resolved path, which now sits OUTSIDE the intended build
   working directory, potentially overwriting developer config,
   dotfiles, shell profile fragments, or other host-side files reachable
   by the resolved path.
 
7. Depending on what was overwritten, the attacker gains a foothold for
   code execution on the next shell/login, persistence on the
   developer's workstation, or corruption of files a CI build agent
   depends on for subsequent steps.

Impact of Successful Exploitation

Immediate Remediation

Update Flatpak to the fixed version

On most distributions, Flatpak itself is a system package, not something updated through the Flatpak/Flathub application layer:

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade flatpak
 
# Fedora / RHEL / CentOS Stream
sudo dnf upgrade flatpak
 
# Arch Linux
sudo pacman -Syu flatpak
 
# Confirm the installed version
flatpak --version

Confirm the installed version is 1.18.1 or later on the mainline branch, or that your distribution has applied the flatpak-1.16.x LTS backport (which also requires the accompanying libglnx glnx_chaseat_full / glnx_chase_and_mkdirat changes — check your distribution's changelog or package advisory rather than assuming a point release alone is sufficient).

Verify only trusted SDKs and remotes are in use

• Audit flatpak remotes on every workstation and CI build agent; remove any remote you don't recognize or can't attribute to a trusted publisher.
• Treat SDK containers the same way you'd treat a build-time dependency in any other ecosystem — pin to a known-good, signed source, and don't add third-party SDK remotes on a whim to unblock a one-off build.
• For CI pipelines, pin the exact SDK reference (repo + ref + expected checksum where possible) rather than resolving "latest" from a remote you don't control.

Mitigations if you can't patch immediately

• Avoid --sdk-extension and --base-extensions against any SDK you don't fully trust. The vulnerable code path is only reached when extension copying happens during build-init.
• Run build-init in a sandboxed or ephemeral environment (disposable container/VM, or a CI runner that is destroyed after each job) so that any traversal write lands somewhere disposable rather than on a persistent developer workstation.
• Avoid running build-init as a privileged user, and avoid running it against SDKs pulled from ad-hoc or community remotes on machines that also hold sensitive credentials or SSH keys.

Detection Indicators

Post-Remediation Steps

1. Confirm the installed Flatpak version on every affected workstation and CI build agent is 1.18.1 or later (mainline) or carries the flatpak-1.16.x backport.
2. Audit flatpak remotes fleet-wide for unfamiliar or unattributed SDK sources, and remove any that aren't explicitly required and trusted.
3. On any system that ran build-init --sdk-extension (or --base-extensions) against an SDK from an untrusted or since-removed remote, scan for unexpected file changes outside the relevant build directories, particularly in home-directory config paths.
4. If a CI/CD build agent was among the affected systems, rotate any credentials, tokens, or SSH keys that agent had access to, and review recent build artifacts it produced for signs of tampering before treating them as trustworthy.

References

• NVD — CVE-2026-96276
• GitHub Security Advisory GHSA-8qxj-x646-phcm — Arbitrary write in host context via flatpak build-init
• Red Hat — CVE-2026-96276
• Red Hat Bugzilla #2539418