This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236). - CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515). - CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519). - CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520). - CVE-2026-96283: flatpak-system-helper: cross-user `CancelPull` orphans another user's ongoing pull (bsc#1282521). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523). - CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).
Last supporting evidence check: 2026-10-21T15:44:17.094Z UTC
flatpak 1.4.2-0
libflatpak0 1.4.2-0
typelib-1_0-Flatpak-1_0 1_0-1.4.2