[CLSA-2026:1793178530] flatpak: Fix of CVE-2026-96275
Type:
security
Severity:
Important
Release date:
2026-10-28 09:09:01 UTC
Description:
- CVE-2026-96275: fix path traversal when extracting extra data, by refusing a symlinked files/extra and rejecting extra-data names containing ".", ".." or "/"
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:b24546d15a43cde9eca380f33615c1d5e0b73a994f5a8906b7f6312f9988a2e8
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:1fe97cf02f4667ec6b1e4b1a7576420b5862d9971c9da48a3225cf8ecc0aab63
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:f62dda31d199a4acbc9bf4252ef843b0fa647dcaa6ee9d6a284089d17079eecd
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:f7614f7ca050adc655838b96b438a09393e5fff47521b011354135f306425ca9
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:136dd5f67ba2de3d435611388c5bfac1dcaed3ede41ee5edaabaeef3a8959473
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:03a90824da18bb1668f15ec17de31d3a5658afc607d589f3c15cd31022e82d77
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.i686.rpm
    sha:8e38196cd0b96b02f5ffbe3ab260fa6cb21e2d99d8d8f36786ecd311c7427662
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els4.x86_64.rpm
    sha:a78c8e5c75fb66ac6682f2676aaf614cb8e9adf179407897114773ffce9ff63c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.