[CLSA-2026:1792032323] flatpak: Fix of 4 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-17 14:55:08 UTC
Description:
- CVE-2026-90616: fix symlink-following sandbox escape in app data dir creation and /var bind mounts
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.el7.tuxcare.els5.i686.rpm
    sha:a0bc838ef91248bad9a95af561005a5a9cc40e306c24eede4d872639773e97b2
  • flatpak-1.0.9-13.el7.tuxcare.els5.x86_64.rpm
    sha:4186621c670236447161a22c70ca256137f4147a9b9d0b6adabbf421864d6bea
  • flatpak-builder-1.0.0-13.el7.tuxcare.els5.i686.rpm
    sha:751a1299637c2fa7b1cfee22b8362692f1cd28f8205d4d3b70d69341a7173360
  • flatpak-builder-1.0.0-13.el7.tuxcare.els5.x86_64.rpm
    sha:3af304641a0e1ce7466c10fe0274021c88353a9f4f8e46cca402699acf358a32
  • flatpak-devel-1.0.9-13.el7.tuxcare.els5.i686.rpm
    sha:ec7c382a2ba30927f48694616ecd5138d9c0218fa520a02b5f255af06babd6fb
  • flatpak-devel-1.0.9-13.el7.tuxcare.els5.x86_64.rpm
    sha:b22ac48e526fa0c08f2c223c836bfdbb58f04a7190a8e56df18dc286544475fb
  • flatpak-libs-1.0.9-13.el7.tuxcare.els5.i686.rpm
    sha:f7bca3c87a3566ebad90dddb1de74d653b448a690c1c2dc11f9da93244f48c1c
  • flatpak-libs-1.0.9-13.el7.tuxcare.els5.x86_64.rpm
    sha:065d315f9b1ed86bbbe1314ba58a4aee4b8e4ff0352fb851ab04928e67fa6575
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.