CVE-2026-97023 — Flatpak: arbitrary file deletion in root context via path traversal in the deploy directory export/bin

A path traversal vulnerability in Flatpak’s handling of the export/bin directory during app deployment may allow a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory. In system-wide installations, the deletion is performed as root.