Red Hat Product Errata RHSA-2026:25068 - Security Advisory Issued: 2026-06-10 Updated: 2026-06-10 RHSA-2026:25068 - Security Advisory Overview Updated Packages Synopsis Important: flatpak security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for flatpak is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2456276 - CVE-2026-34078 flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options BZ - 2456284 - CVE-2026-34079 flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation CVEs CVE-2026-34078 CVE-2026-34079 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 SRPM flatpak-1.12.9-1.el8_8.src.rpm SHA-256: 268b4d85d1719dd162e25a2e06e4efd9456cd31ced538fe5b6ea1a6282732d3d x86_64 flatpak-1.12.9-1.el8_8.x86_64.rpm SHA-256: 42e19e1f8f2250193ff55986809693e2954a6612e15b3e1f63545aac76bfa392 flatpak-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 1f782c71e56bdc7d9cbbc147708bd75ca21eb4f1460f7cdb2edbab50b7f66a5b flatpak-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 497dd6319d452405c7a16069fa78376acfdbc945f6069d04dcee3aa91091c953 flatpak-debugsource-1.12.9-1.el8_8.i686.rpm SHA-256: 002cd551dc226e9e7c4a24554381ad6de09abbc22336b963f37e8a78260b0606 flatpak-debugsource-1.12.9-1.el8_8.x86_64.rpm SHA-256: ba7ddbfa05e8ac8b7e51113e5471df850904109c0054bcc3019aef927380fa25 flatpak-libs-1.12.9-1.el8_8.i686.rpm SHA-256: 9800a22088047b952e005fe41f6b6d60a3631e13e9166bc75dfbcf57ec13c78b flatpak-libs-1.12.9-1.el8_8.x86_64.rpm SHA-256: 6f1546418507df8d3376b2809909f0975b25e2dbaba24446559de7b1a05d98f3 flatpak-libs-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 33a251d82de9058ba374fd9742151689a7203707b555dd8791a3439c7bfa635d flatpak-libs-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 2500dc4778d64f83190d76c27a9af7669dd68ef7e2cf0e4b0e6b32e162c4feb6 flatpak-selinux-1.12.9-1.el8_8.noarch.rpm SHA-256: 0c37c175c363ea5e799e6c42f1bf6af80d94889a853ddd96cc85598d7e7828cd flatpak-session-helper-1.12.9-1.el8_8.x86_64.rpm SHA-256: 51034ae5269868fd3b2daf691adf12e963ef0fc5efa992928e0091a0a85dbd3c flatpak-session-helper-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: fe82eeee8c344b4cc555a252543e2867c58dab495d278c62a23875a9eb787574 flatpak-session-helper-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 55c9f3d96a63c8114698529f7e4ff2f79b597948555bb7fda09dc5a98a85e3df flatpak-tests-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 813ad81b90fbfb4b1a1a10c5462b2b05e2eba1a347fccbbc3ab0d3c5b914da9e flatpak-tests-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 94d93bf3ecebdd381f1f74887b4ff3faabec803e74714fd1ea0f93149b7c4501 Red Hat Enterprise Linux Server - TUS 8.8 SRPM flatpak-1.12.9-1.el8_8.src.rpm SHA-256: 268b4d85d1719dd162e25a2e06e4efd9456cd31ced538fe5b6ea1a6282732d3d x86_64 flatpak-1.12.9-1.el8_8.x86_64.rpm SHA-256: 42e19e1f8f2250193ff55986809693e2954a6612e15b3e1f63545aac76bfa392 flatpak-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 1f782c71e56bdc7d9cbbc147708bd75ca21eb4f1460f7cdb2edbab50b7f66a5b flatpak-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 497dd6319d452405c7a16069fa78376acfdbc945f6069d04dcee3aa91091c953 flatpak-debugsource-1.12.9-1.el8_8.i686.rpm SHA-256: 002cd551dc226e9e7c4a24554381ad6de09abbc22336b963f37e8a78260b0606 flatpak-debugsource-1.12.9-1.el8_8.x86_64.rpm SHA-256: ba7ddbfa05e8ac8b7e51113e5471df850904109c0054bcc3019aef927380fa25 flatpak-libs-1.12.9-1.el8_8.i686.rpm SHA-256: 9800a22088047b952e005fe41f6b6d60a3631e13e9166bc75dfbcf57ec13c78b flatpak-libs-1.12.9-1.el8_8.x86_64.rpm SHA-256: 6f1546418507df8d3376b2809909f0975b25e2dbaba24446559de7b1a05d98f3 flatpak-libs-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 33a251d82de9058ba374fd9742151689a7203707b555dd8791a3439c7bfa635d flatpak-libs-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 2500dc4778d64f83190d76c27a9af7669dd68ef7e2cf0e4b0e6b32e162c4feb6 flatpak-selinux-1.12.9-1.el8_8.noarch.rpm SHA-256: 0c37c175c363ea5e799e6c42f1bf6af80d94889a853ddd96cc85598d7e7828cd flatpak-session-helper-1.12.9-1.el8_8.x86_64.rpm SHA-256: 51034ae5269868fd3b2daf691adf12e963ef0fc5efa992928e0091a0a85dbd3c flatpak-session-helper-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: fe82eeee8c344b4cc555a252543e2867c58dab495d278c62a23875a9eb787574 flatpak-session-helper-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 55c9f3d96a63c8114698529f7e4ff2f79b597948555bb7fda09dc5a98a85e3df flatpak-tests-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 813ad81b90fbfb4b1a1a10c5462b2b05e2eba1a347fccbbc3ab0d3c5b914da9e flatpak-tests-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 94d93bf3ecebdd381f1f74887b4ff3faabec803e74714fd1ea0f93149b7c4501 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 SRPM flatpak-1.12.9-1.el8_8.src.rpm SHA-256: 268b4d85d1719dd162e25a2e06e4efd9456cd31ced538fe5b6ea1a6282732d3d ppc64le flatpak-1.12.9-1.el8_8.ppc64le.rpm SHA-256: af2fae86025d052515ae79a875f18d05fb9704c94670a14b515f6528c8ffc153 flatpak-debuginfo-1.12.9-1.el8_8.ppc64le.rpm SHA-256: 657560f50fd29c40fdfc2651d2ef4777d1a635780005efe9fefd1c4c37255b50 flatpak-debugsource-1.12.9-1.el8_8.ppc64le.rpm SHA-256: bb9fed0ee0c9c05882bcc8e831e07996e9dab99a298f91ff8f02a76e1501eb51 flatpak-libs-1.12.9-1.el8_8.ppc64le.rpm SHA-256: 5d6a6108dca0a0d90522a27fac4ce87b3952793613b511df0a766250e346c5e5 flatpak-libs-debuginfo-1.12.9-1.el8_8.ppc64le.rpm SHA-256: 188f57debff24bbf8570861fe76d78c81bbfee8be1d9fa54965991001efd77a6 flatpak-selinux-1.12.9-1.el8_8.noarch.rpm SHA-256: 0c37c175c363ea5e799e6c42f1bf6af80d94889a853ddd96cc85598d7e7828cd flatpak-session-helper-1.12.9-1.el8_8.ppc64le.rpm SHA-256: e40a3b952d1c7e8b86a28a832bfb092697916c3b92d0a499002b92147b6aa47d flatpak-session-helper-debuginfo-1.12.9-1.el8_8.ppc64le.rpm SHA-256: 1e62498d84af4820c37c2d0120a108c9c77d300d2a54da2ff2d62b313422477b flatpak-tests-debuginfo-1.12.9-1.el8_8.ppc64le.rpm SHA-256: fce4ec47049cc50ae69bfe0b13b1028509e347b13d093060d3eae0d9573c6eab Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 SRPM flatpak-1.12.9-1.el8_8.src.rpm SHA-256: 268b4d85d1719dd162e25a2e06e4efd9456cd31ced538fe5b6ea1a6282732d3d x86_64 flatpak-1.12.9-1.el8_8.x86_64.rpm SHA-256: 42e19e1f8f2250193ff55986809693e2954a6612e15b3e1f63545aac76bfa392 flatpak-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 1f782c71e56bdc7d9cbbc147708bd75ca21eb4f1460f7cdb2edbab50b7f66a5b flatpak-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 497dd6319d452405c7a16069fa78376acfdbc945f6069d04dcee3aa91091c953 flatpak-debugsource-1.12.9-1.el8_8.i686.rpm SHA-256: 002cd551dc226e9e7c4a24554381ad6de09abbc22336b963f37e8a78260b0606 flatpak-debugsource-1.12.9-1.el8_8.x86_64.rpm SHA-256: ba7ddbfa05e8ac8b7e51113e5471df850904109c0054bcc3019aef927380fa25 flatpak-libs-1.12.9-1.el8_8.i686.rpm SHA-256: 9800a22088047b952e005fe41f6b6d60a3631e13e9166bc75dfbcf57ec13c78b flatpak-libs-1.12.9-1.el8_8.x86_64.rpm SHA-256: 6f1546418507df8d3376b2809909f0975b25e2dbaba24446559de7b1a05d98f3 flatpak-libs-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 33a251d82de9058ba374fd9742151689a7203707b555dd8791a3439c7bfa635d flatpak-libs-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 2500dc4778d64f83190d76c27a9af7669dd68ef7e2cf0e4b0e6b32e162c4feb6 flatpak-selinux-1.12.9-1.el8_8.noarch.rpm SHA-256: 0c37c175c363ea5e799e6c42f1bf6af80d94889a853ddd96cc85598d7e7828cd flatpak-session-helper-1.12.9-1.el8_8.x86_64.rpm SHA-256: 51034ae5269868fd3b2daf691adf12e963ef0fc5efa992928e0091a0a85dbd3c flatpak-session-helper-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: fe82eeee8c344b4cc555a252543e2867c58dab495d278c62a23875a9eb787574 flatpak-session-helper-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 55c9f3d96a63c8114698529f7e4ff2f79b597948555bb7fda09dc5a98a85e3df flatpak-tests-debuginfo-1.12.9-1.el8_8.i686.rpm SHA-256: 813ad81b90fbfb4b1a1a10c5462b2b05e2eba1a347fccbbc3ab0d3c5b914da9e flatpak-tests-debuginfo-1.12.9-1.el8_8.x86_64.rpm SHA-256: 94d93bf3ecebdd381f1f74887b4ff3faabec803e74714fd1ea0f93149b7c4501 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .