{
  "cveId": "CVE-2026-76925",
  "url": "https://patchblox.com/security/cve/CVE-2026-76925",
  "summary": "CVE-2026-76925 is fixed in 11 products on 1 platform, first by ALAS2023-2026-3143, released September 28, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "flatpak-tests: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-96808:\n\tIn Flatp...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-96808:\n\tIn Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session\u0027s directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.\n\nCVE-2026-96275:\n\tA malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: \u0060files/extra\u0060 is resolved via path operations that follow symlinks, and blob names from \u0060xa.extra-data-sources\u0060 are not sanitized against \u0060..\u0060 traversal.\n\nCVE-2026-90616:\n\tIn Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.\n\nCVE-2026-76925:\n\tA flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the \u0060org.freedesktop.Flatpak.SystemHelper\u0060 component. This vulnerability occurs because a privileged \u0060chmod\u0060 operation executes before the OSTree repository validation within the \u0060Deploy()\u0060 function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.",
  "published": "2026-09-28T09:00:00Z",
  "severity": "important",
  "epss": 0.00103,
  "epssPercentile": 0.00955,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "flatpak",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-libs",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-selinux",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-session-helper",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-session-helper-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-tests",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "flatpak-tests-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.18.1-1.amzn2023",
      "fix": "ALAS2023-2026-3143",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3143",
      "released": "2026-09-28T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}