{
  "cveId": "CVE-2026-96282",
  "url": "https://patchblox.com/security/cve/CVE-2026-96282",
  "summary": "CVE-2026-96282 is fixed in flatpak on 1 platform, first by DEBIAN-CVE-2026-96282, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "flatpak: A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrar...",
  "description": "A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.",
  "published": "2026-09-27T22:17:06Z",
  "severity": "low",
  "cvss": 3.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "epss": 0.00239,
  "epssPercentile": 0.1506,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "flatpak",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.16.6-1~deb13u2",
      "fix": "DEBIAN-CVE-2026-96282",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-96282",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "flatpak",
      "release": "Debian 14",
      "fixedVersion": "1.18.1-1",
      "fix": "DEBIAN-CVE-2026-96282",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-96282",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "flatpak",
      "release": "sles 15.6",
      "fixedVersion": "1.16.6-150600.3.12.1",
      "fix": "SUSE-SU-2026:4944-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4944-1",
      "released": "2026-11-07T00:43:02Z"
    },
    {
      "platform": "linux",
      "product": "flatpak",
      "release": "sles 15.7",
      "fixedVersion": "1.16.6-150600.3.12.1",
      "fix": "SUSE-SU-2026:4944-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4944-1",
      "released": "2026-11-07T00:43:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}