CVE-2026-92162

CVE-2026-92162 is a path-traversal vulnerability affecting Flatpak versions 1.18.0 and earlier. The issue resides in the `DeployAppstream` functionality of the `flatpak-system-helper` process, where there is insufficient validation of the architecture (`arch`) parameter. On systems with at least one Open Container Initiative (OCI) remote configured—a setup common in distributions like Fedora—a local user in an active session can exploit this by supplying a crafted architecture name. This tricks the system helper into creating a root-owned directory tree, lock file, and icons directory outside of the designated root directory, with contents determined by the OCI remote. While the vulnerability is not believed to be exploitable on systems without configured OCI remotes, it can lead to local root privilege escalation when combined with other vulnerabilities. The issue has been addressed and patched in Flatpak version 1.18.1, which introduces proper validation for remote names and architecture arguments.