[CLSA-2026:1793197215] flatpak: Fix of CVE-2026-96275
Type:
security
Severity:
Important
Release date:
2026-10-28 18:26:55 UTC
Description:
- CVE-2026-96275: fix path traversal when extracting extra data, by refusing a symlinked files/extra and rejecting extra-data names containing ".", ".." or "/"
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:ed4956036cecac3b2a1a98cc18c444076a67bcaa1081c364d26a22f9e58eb762
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:16837656d9f6a46d0c581da97ec303c151a3bba3f3f67b33ecd1c69396e12438
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:3cf96560c62c71854dc90924905313e59dc403327bef2f49f20388607f57d973
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:d679b96d94ab6ac00b9c9a7308fa30e3c8cf67512c37a658b5312ee39b246d3f
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:cf877538c7167b7ec6cdd2303eb7571066984265c94262f80ebe40aca2213f37
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:ce14e52eb8b35c445ee073a60492abd9368b9adb265faab59286b6bbf88e27e9
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:f3d89c26481c41c7dcc845e6fb3488c1f37c6b0e868cc0fec48ec7ce77c76925
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:98ed453521ad1b0645195b0d013f98342c89e8a4d8d41f6bb72147504a6e80f5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.