PT-2026-31025 · Flatpak+1 · Flatpak+1

Published 2026-04-07 · Updated 2026-05-28 · CVE-2026-34079

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.16.4

Description Flatpak, a Linux application sandboxing and distribution framework, contained a flaw where the caching mechanism for ld.so did not adequately verify that an application-controlled path to an outdated cache resided within the cache directory. This allowed Flatpak applications to delete arbitrary files on the host system.

Recommendations Update to Flatpak version 1.16.4 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2026:21755

ALSA-2026:21756

ALSA-2026:21757

BDU:2026-05832

CVE-2026-34079

OPENSUSE-SU-2026:10541-1

SUSE-SU-2026:1511-1

SUSE-SU-2026:1541-1

SUSE-SU-2026:1600-1

Affected Products

Flatpak

Rocky Linux

References · 38

• https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-21755.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1511-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:21755 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-21756.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34079 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1541-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34079 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-21756.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10541-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05832 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1600-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34079 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:21756 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:21756 · Vendor Advisory