CVE-2026-96284

Description

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

Traduire en français

Produits concernés

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9

Scores CVSS

Faiblesses (CWE)

• CWE-59

Références

• https://access.redhat.com/security/cve/CVE-2026-96284
• https://bugzilla.redhat.com/show_bug.cgi?id=2539423
• https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories