SUSE-SU-2026:4610-1: flatpak&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

CVSS: UnknownPublished
Published 09-10-2026Last modified 10-10-2026
Open JSON

Vulnerability summary

SUSE-SU-2026:4610-1 is a vulnerability in flatpak&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 9 · Downstream 0 · Related 9
CVE-2026-90616CVE-2026-92162CVE-2026-96275CVE-2026-96276CVE-2026-96281CVE-2026-96282

Timeline

  1. 09-10-2026
    PublishedVulnerability first disclosed.
  2. 10-10-2026
    Last modifiedVulnerability information updated.

Description

Security update for flatpak This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236). - CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515). - CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519). - CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520). - CVE-2026-96283: flatpak-system-helper: cross-user `CancelPull` orphans another user's ongoing pull (bsc#1282521). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523). - CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse2 products
  • flatpak&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 1.4.2-3.15.1
  • flatpak&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 1.4.2-3.15.1

1 vendor · 2 products

References

19 links
Show all 19 references