CVE-2026-92162: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-92162 is a path traversal vulnerability in Flatpak's DeployAppstream functionality caused by an unvalidated arch (architecture) parameter. On systems with at least one OCI remote configured (most commonly Fedora-based systems), a malicious local user in an active session can craft an architecture name to cause the flatpak-system-helper process to create root-owned directory trees outside the intended root directory. Affected versions are Flatpak ≤ 1.18.0; the fix is available in version 1.18.1. The vulnerability is estimated as HIGH severity by Feedly, and was published on August 11, 2026 (GitHub Advisory).

The root cause is insufficient validation of the arch parameter passed to the DeployAppstream operation in the flatpak-system-helper process, which runs with elevated (root) privileges. By supplying a crafted architecture name containing path traversal sequences, an attacker can cause the helper to create directories and files — including a root-owned lock file and icons directory — at arbitrary filesystem locations outside the intended installation root, with contents sourced from a remote OCI registry. This is classified as a path traversal issue (CWE-22). The vulnerability was fixed by commits 19456b9 (making remote name validation public) and 01773f8 (validating each remote name and architecture argument) in the flatpak repository (GitHub Advisory).

A successful exploit allows a malicious local user to cause the privileged flatpak-system-helper process to create root-owned directory trees at attacker-controlled filesystem paths, with contents partially determined by an OCI remote. While this vulnerability alone does not directly grant root access, the advisory explicitly states that when combined with other vulnerabilities also fixed in Flatpak 1.18.1, the combination can lead to local root privilege escalation. The primary risk is to system integrity and, in chained exploit scenarios, full local privilege escalation (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation as of the available data. The vulnerability requires a local, authenticated user session and is only exploitable on systems with at least one OCI remote configured — a condition most common on Fedora-based distributions. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory, Feedly).

1. Prerequisite check: Confirm the target system has at least one OCI remote configured in Flatpak (e.g., flatpak remotes on Fedora-based systems) and that the attacker has an active local user session.
2. Craft malicious architecture name: Construct a specially crafted arch parameter value containing path traversal sequences (e.g., ../../target/path) designed to escape the intended installation root directory.
3. Trigger DeployAppstream: Invoke the Flatpak client-side operation that calls DeployAppstream via D-Bus to the privileged flatpak-system-helper process, supplying the crafted architecture name as the arch argument.
4. Observe root-owned directory creation: The flatpak-system-helper process, running as root, creates directories and files (including a lock file and icons directory) at the attacker-specified path outside the intended root, with contents sourced from the configured OCI remote.
5. Chain with additional vulnerabilities: Combine this primitive with other vulnerabilities fixed in Flatpak 1.18.1 to achieve full local root privilege escalation (GitHub Advisory).

• File System: Unexpected root-owned directories or files created outside /var/lib/flatpak or the configured Flatpak installation root; presence of root-owned lock files or icons directories in unusual filesystem locations.
• Logs: System logs (e.g., journalctl) showing flatpak-system-helper creating directories or files at unexpected paths; D-Bus activity logs showing unusual DeployAppstream calls with non-standard architecture parameter values.
• Process: flatpak-system-helper spawning file creation operations targeting paths outside expected Flatpak directories (GitHub Advisory).

Upgrade Flatpak to version 1.18.1 or later, which contains the fixes in commits 19456b9 and 01773f8 that validate remote name and architecture arguments. For LTS distributions (e.g., Ubuntu), backports are available in the flatpak-1.16.x branch. As a workaround, systems without any OCI remotes configured are not believed to be exploitable — administrators can audit and remove unnecessary OCI remotes via flatpak remotes. Debian has accepted the fix into unstable (flatpak 1.18.3-1) (GitHub Advisory, Debian Tracker).

The vulnerability was reported by security researcher Yehia Ali Mohamed Ezzat (handle: 0xSemizzz) and disclosed via the GitHub Security Advisory on August 11, 2026. The Debian project accepted the patched version into unstable shortly after disclosure. The oss-security mailing list carried a notification, and Tenable published Nessus detection plugins (IDs 349075 and 350953) for the vulnerability (oss-security, Tenable Nessus, Debian Tracker).