CVE-2026-96282
LOWCVSS 3.1Description
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Timeline
Published:September 27th, 2026 10:17 PM
Last modified:September 29th, 2026 9:29 PM
CVSS Scoring
CVSS v3: 3.1 (LOW)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute