Low [CVE-2026-96282] Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Exploitation requires a user to install a malicious Flatpak extension and use it with an application (AV:N, PR:N).

The victim must specifically use a malicious extension in combination with a consuming application, and then launch that application (AC:H, UI:R).

When Flatpak launches an application, it performs host-side file operations inside extension content directories using path-based APIs that follow symlinks without confinement; a malicious extension can place symlinks pointing at arbitrary host paths, which are followed both when checking for the.ref lock marker file and when iterating merge_dirs directories.

These operations run at the invoking user's own privilege level rather than via the privileged system-helper (S:U). While the flaw allows probing for file/directory existence and disclosing filenames via reflected directory listings, no file contents are disclosed (C:N).