Flatpak EUVD-2026-88624

Requires the victim to install or upgrade an attacker-supplied malicious Flatpak application that contains crafted path-traversal entries in its files/etc directory - this is the mandatory user-interaction gate (UI:R). Maximum impact (root-level writes to host files) occurs specifically in system-wide (per-system, root) Flatpak installations; per-user installs limit the damage to files writable by that user. Exploitation is therefore constrained by the need for a social-engineering / untrusted-source delivery step: the attacker cannot trigger it purely remotely without the user electing to install the app. No host authentication of the attacker is required.

This is a genuine but moderate-priority integrity/availability issue rather than a critical remote code execution flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, base 7.1) reflects the key trade-off: exploitation is low-complexity and needs no host authentication (PR:N), but it is gated by user interaction (UI:R) because a victim must actually install or upgrade the malicious Flatpak app. There is no confidentiality impact (C:N); the damage is limited-integrity corruption (I:L - emptying files or swapping them for symlinks, not arbitrary content control) with high availability impact (A:H - clobbering passwd, group, machine-id, or resolv.conf can break host services or identity). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is theoretical at time of analysis. Note a conflict worth flagging: the vector marks S:U, yet the flaw crosses the Flatpak sandbox boundary to write host files as root in system-wide installs, which is a strong argument for scope change (S:C) - verify with the vendor advisory. The AV:N rating is also debatable, since the true precondition is a user choosing to install an untrusted package, which is closer to a supply-chain/social-engineering vector than pure network reach.

An attacker publishes or distributes a malicious Flatpak app (e.g., via an untrusted repository or a shared .flatpak bundle) whose files/etc directory contains crafted path-traversal entries. When a victim installs or upgrades the app - as root for a system-wide install - Flatpak's deployment logic follows the traversal and empties or symlink-replaces host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf, degrading or breaking the host system. No public exploit code was identified at time of analysis.