CVE-2026-96807CWE-61

CVE-2026-96807

Medium · published September 23, 2026

CVSS v3.1
4.0
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00123 · 1.9th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-09-23T21:17Z
References (1)
https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x · [email protected]
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 23 SEP 16:54Z
    In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an…
    cvelistv5