MGASA-2026-0477

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0477.html
Import Source
https://advisories.mageia.org/MGASA-2026-0477.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0477
Upstream
CVE (6)
  • CVE-2026-97023
  • CVE-2026-97024
  • CVE-2026-97025
  • CVE-2026-97026
  • CVE-2026-97027
  • CVE-2026-97029
Published
2026-10-09T17:00:24Z
Modified
2026-10-09T17:15:03Z
Summary
Updated flatpak package fixes security vulnerabilities
Details

Arbitrary file deletion in root context via path traversal in deploy directory export/bin. (CVE-2026-97023) Arbitrary write in root context via path traversal in deploy directory files/etc. (CVE-2026-97024) World-readable oci authentication token in system-helper cache path. (CVE-2026-97025) World-writable temporary child repositories in system-helper cache path. (CVE-2026-97026) Denial of service via unsanitized keys in exported desktop entry / d-bus service files. (CVE-2026-97027) Sandboxed app can signal unsandboxed processes in the same process group. (CVE-2026-97029)

References
Credits

Affected packages

Mageia:10 / flatpak

Package

Name
flatpak
Purl
pkg:rpm/mageia/flatpak?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.16.6-1.2.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0477.json"