[CLSA-2026:1793178088] flatpak: Fix of CVE-2026-96275
Type:
security
Severity:
Important
Release date:
2026-10-28 09:01:38 UTC
Description:
- CVE-2026-96275: fix path traversal when extracting extra data, by refusing a symlinked files/extra and rejecting extra-data names containing ".", ".." or "/"
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:17004711bcb026888607cdc4ddd1daa558b82b08d1d3717b4f09a3db9ac3b11c
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:525733824403746687152b82c41556e692b68b3f6ead03c86d61097bbc01119b
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:2ca48695af6c3a0f8610e5cc7c859c7129fb1f4cfc97482a4535434a6c5883ff
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:8228046be7bde4bff817af45f7047e536284e12469203b8d9fc7cffbddf14ec4
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:b9a1b67f45d39a7ebef3f7b07f51519cf5221886463aed5911b4f8473fcd8414
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:667299cfbe0214c6b99bd55af710e6a9129aa07948d836a750e66670ad4212d7
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:a17bde4838ffdb7f37ed5f4918249e690e594bae1303901d5daee9bed9d7e9ba
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:974c3ddb2f29c7c8f77023e51b9e4e4141ec0064a05fb7b13058cc7077281439
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.