An update for flatpak is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4309 Final 1.0 1.0 2026-10-16 Initial 2026-10-16 2026-10-16 openEuler SA Tool V1.0 2026-10-16 flatpak security update An update for flatpak is now available for openEuler-24.03-LTS-SP3 flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fix(es): A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.(CVE-2026-96282) By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.(CVE-2026-96283) An update for flatpak is now available for openEuler-20.03-LTS-SP4/openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Low flatpak https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4309 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-96282 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-96283 https://nvd.nist.gov/vuln/detail/CVE-2026-96282 https://nvd.nist.gov/vuln/detail/CVE-2026-96283 openEuler-24.03-LTS-SP3 flatpak-1.10.2-15.oe2403sp3.aarch64.rpm flatpak-debuginfo-1.10.2-15.oe2403sp3.aarch64.rpm flatpak-debugsource-1.10.2-15.oe2403sp3.aarch64.rpm flatpak-devel-1.10.2-15.oe2403sp3.aarch64.rpm flatpak-1.10.2-15.oe2403sp3.src.rpm flatpak-1.10.2-15.oe2403sp3.x86_64.rpm flatpak-debuginfo-1.10.2-15.oe2403sp3.x86_64.rpm flatpak-debugsource-1.10.2-15.oe2403sp3.x86_64.rpm flatpak-devel-1.10.2-15.oe2403sp3.x86_64.rpm flatpak-help-1.10.2-15.oe2403sp3.noarch.rpm A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox. 2026-10-16 CVE-2026-96282 openEuler-24.03-LTS-SP3 Low 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N flatpak security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4309 By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped. 2026-10-16 CVE-2026-96283 openEuler-24.03-LTS-SP3 Low 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L flatpak security update 2026-10-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4309