OESA-2026-4309

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4309

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4309.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4309

Upstream

CVE (2)

CVE-2026-96282
CVE-2026-96283

Published

2026-10-16T11:59:12Z

Modified

2026-10-16T12:15:18Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

flatpak security update

Details

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282)

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283)

Database specific

{
    "severity":  "Low"
}

References

Affected packages

openEuler:24.03-LTS-SP3 / flatpak

Package

Name: flatpak
Purl: pkg:rpm/openEuler/flatpak&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.2-15.oe2403sp3

Ecosystem specific

{
    "aarch64":  [
        "flatpak-1.10.2-15.oe2403sp3.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-15.oe2403sp3.aarch64.rpm",
        "flatpak-debugsource-1.10.2-15.oe2403sp3.aarch64.rpm",
        "flatpak-devel-1.10.2-15.oe2403sp3.aarch64.rpm"
    ],
    "noarch":  [
        "flatpak-help-1.10.2-15.oe2403sp3.noarch.rpm"
    ],
    "src":  [
        "flatpak-1.10.2-15.oe2403sp3.src.rpm"
    ],
    "x86_64":  [
        "flatpak-1.10.2-15.oe2403sp3.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-15.oe2403sp3.x86_64.rpm",
        "flatpak-debugsource-1.10.2-15.oe2403sp3.x86_64.rpm",
        "flatpak-devel-1.10.2-15.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4309.json"