rootpwn

critical · CVSS v3 9.1

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious…

Description

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-101261

Ziroom ZHOME A0101 firmware 1.0.1.0 contains a command injection vulnerability in the /api/ZRnetwork/firstSetup_wifi endpoint. Remote attackers can supply a crafted login_pwd parameter to execute arbitrary commands. This flaw could allow full compromise of the device.

View analysis

critical

CVE-2026-97029

Flatpak’s process ID namespace separation fails to isolate kill(0, signal) and killpg(0, signal) calls, allowing a sandboxed app to terminate processes outside its sandbox that share the same process group. This flaw can be exploited to disrupt desktop shells and other system processes, leading to a denial‑of‑service condition. The vulnerability is rated critical with a CVSS v3 score of 9.1.

View analysis

critical

CVE-2026-101354

A stack-based buffer overflow exists in the _tWlanTask function of the MmtAtePrase Parser in FAST FAC1203R firmware 20200116_2.0.4. The flaw can be triggered by a local network attacker and may allow arbitrary code execution. The vulnerability is rated critical with a CVSS v3 score of 9.6.

View analysis

critical

CVE-2026-101860

A critical privilege escalation flaw exists in RaspAP raspap-webgui up to version 3.5.5. The flaw allows remote attackers to manipulate the sudoers configuration via the PluginInstaller::addSudoers function, potentially granting root access.

View analysis