Critical severity9.8NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-96276
CVE-2026-96276
Description
If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows .. traversal.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.