CVE-2026-92162

7.2High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.2High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-22

Impact

A local attacker with an active session can gain root privileges when chained with companion bugs. It requires at least one OCI remote configured on the system.

Root cause

A path traversal vulnerability via a crafted architecture name allows flatpak-system-helper to create root-owned directories and files outside the intended root directory.

Affected systems

Flatpak versions prior to 1.18.1

CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Flatpak to 1.18.1 or later. If patching immediately is not possible, remove any configured OCI remotes.

shell

$ flatpak remote-list

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-92162