Flatpak
Monthly
Path traversal in Flatpak's app deployment handling of the exported files/etc directory allows a malicious Flatpak application to empty or replace host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf with a symlink when that app is installed or upgraded; on system-wide installations the write is carried out as root. Exploitation is gated on user interaction: the victim must choose to install or upgrade the attacker-supplied app from an untrusted source (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R with high availability and low integrity impact), making this a genuine but moderate-priority integrity/availability issue rather than a critical remote code execution flaw. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Path traversal in Flatpak's handling of the export/bin directory during application deployment allows a malicious Flatpak app to delete attacker-chosen files outside the deployment directory when that app is installed or upgraded; on system-wide installations the deletions are carried out with root privileges, so a crafted package can remove arbitrary files anywhere the deployer can reach. The flaw affects Flatpak releases before 1.18.4 and is triggered by a user or administrator installing or upgrading an attacker-supplied app, which supplies the required user interaction rather than a network-based trigger; the CVSS vector carries PR:N, so no prior authentication is needed beyond that install action. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation, though the integrity and availability impact is high (arbitrary file deletion) and the flaw crosses a privilege boundary on system-wide installs.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Path traversal in Flatpak's `flatpak build-init` command allows an attacker-controlled SDK container to write arbitrary files outside the developer's working directory when that developer builds against the SDK using both the `--writable-sdk` and `--sdk-extension` flags. The root cause (CWE-22) is that the SDK's declared extension-point `directory` value is resolved through a path helper that does not reject `..` components, so a malicious SDK can steer writes outside the intended build root. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a local, user-interaction-dependent action rather than the remote 9.8 originally submitted; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the attacker must convince the developer to consume a hostile SDK, which severely limits real-world exposure.
Message-filtering bypass in xdg-dbus-proxy before 0.1.9 lets a malicious or already-compromised sandboxed application - most notably a Flatpak app, but also deployments under frameworks such as Firejail - escape its confinement and execute arbitrary code on the host by attaching a forged reply serial number to non-reply D-Bus messages. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:P, with high confidentiality, integrity and availability impact scoped to the sandbox-escape boundary) and is rated a genuine high-priority sandbox-escape issue rather than a CVSS-inflated paper risk; the practical precondition is that an attacker must first get code running inside a sandbox that routes its session bus through the vulnerable proxy, typically by tricking a user into installing or launching a hostile or trojanized app. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; vendor-released patch: 0.1.9.
Path traversal in flatpak-builder 1.4.5 through 1.4.7 enables arbitrary host file exfiltration through license-files manifest exploitation. Attacker-crafted manifest with symlink manipulation bypasses g_file_get_relative_path() and g_file_query_file_type() validation, allowing reads outside source directory. Successful exploitation requires user interaction (processing malicious manifest) but grants unauthenticated remote attackers high confidentiality impact with no authentication required. Publicly available exploit code exists. CVSS 7.1 reflects network vector with user participation prerequisite.
Arbitrary file deletion in Flatpak versions prior to 1.16.4 allows sandboxed applications to delete files on the host system via path traversal during ld.so cache cleanup. The vulnerability stems from improper validation of application-controlled paths when removing outdated cache files, enabling applications to escape sandbox constraints and delete arbitrary host files. No active exploitation or public exploit code is confirmed at time of analysis, though the technical barrier is low given the CVSS vector shows network-accessible attack with low complexity and no authentication required.
Sandbox escape in Flatpak versions prior to 1.16.4 allows applications to access arbitrary host filesystem paths and achieve host-level code execution through symlink manipulation in portal sandbox-expose options. The vulnerability requires no authentication (CVSS:4.0 PR:N) and is exploitable over the network with low complexity. No confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the attack primitive is clearly documented in the vendor advisory.
Flatpak before 1.18.4 exposes OCI authentication tokens to other local users when a victim performs an authenticated download of an app or runtime from an OCI repository, allowing a co-located attacker to capture the token and potentially misuse it. The flaw affects multi-user Linux systems and was fixed in Flatpak 1.18.4; no public exploit code or active exploitation is known at this time, and the assessed impact is limited to information disclosure (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Flatpak versions prior to 1.18.4 export .desktop and D-Bus .service files from installed applications to the host without filtering their fields against an allowlist, enabling a malicious Flatpak app to cause denial of service or unintended interactions with host services. Exploitation is local and requires the victim to install a malicious app (from a Flatpak remote or sideloaded bundle); no public exploit code or active exploitation is identified in the available data. The vendor-released patch is Flatpak 1.18.4.
Incorrect permissions on temporary repository cache directories in Flatpak before 1.18.4 allow a local, unprivileged user to read data left behind in /var/tmp/flatpak-cache-* while another user's app or runtime is being downloaded from an OCI repository. Exploitation requires a pre-existing local account on a multi-user host and the transient cache directory to still exist before Flatpak cleans it up, and the result is low-confidentiality information disclosure only - no privilege escalation, code execution, or file modification is possible, and no public exploit identified at time of analysis. The same 1.18.4 release addresses several more serious sibling issues (CVE-2026-97023, CVE-2026-97024, CVE-2026-97025, CVE-2026-97027, CVE-2026-97029), so a single upgrade remediates all of them.
Symlink-following during ld.so cache regeneration in Flatpak before 1.18.1 lets a malicious sandboxed application replace its per-app ~/.var/app/$appid/.ld.so path with a symlink so that Flatpak's regenerate_ld_cache writes cache files at an arbitrary attacker-chosen location. The impact is limited to low-integrity file writes on the local host: the written filenames and content are generated by Flatpak and are not attacker-controlled, so this cannot deliver arbitrary code or leak data, and CVSS 3.1 is 4.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per independent reassessment). Exploitation requires a user to have installed and run an untrusted Flatpak app from a non-trusted source; there is no public exploit code identified at time of analysis, and the vendor's own advisory characterizes it as hard to exploit.
Flatpak xdg-desktop-portal versions before 1.20.4 and 1.21.x before 1.21.1 allow any sandboxed Flatpak application to delete arbitrary files on the host system through a symlink race condition in the g_file_trash function. The vulnerability exploits insufficient validation of file paths during trash operations, enabling local privilege escalation from a confined container context to affect host files. CVSS severity is low (2.9) due to high attack complexity and local-only vector, but the impact affects all Flatpak users whose host system contains a vulnerable xdg-desktop-portal installation.
Policy parser vulnerability in xdg-dbus-proxy prior to 0.1.7 allows authenticated local users to bypass eavesdrop restrictions and intercept D-Bus messages by exploiting improper whitespace handling in policy rule parsing. The proxy fails to normalize eavesdrop policy directives, permitting attackers to craft malformed policies (e.g., eavesdrop ='true' with spacing variations) that evade the eavesdrop=true access control checks. No public exploit code has been identified at time of analysis.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Path traversal in Flatpak's app deployment handling of the exported files/etc directory allows a malicious Flatpak application to empty or replace host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf with a symlink when that app is installed or upgraded; on system-wide installations the write is carried out as root. Exploitation is gated on user interaction: the victim must choose to install or upgrade the attacker-supplied app from an untrusted source (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R with high availability and low integrity impact), making this a genuine but moderate-priority integrity/availability issue rather than a critical remote code execution flaw. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Path traversal in Flatpak's handling of the export/bin directory during application deployment allows a malicious Flatpak app to delete attacker-chosen files outside the deployment directory when that app is installed or upgraded; on system-wide installations the deletions are carried out with root privileges, so a crafted package can remove arbitrary files anywhere the deployer can reach. The flaw affects Flatpak releases before 1.18.4 and is triggered by a user or administrator installing or upgrading an attacker-supplied app, which supplies the required user interaction rather than a network-based trigger; the CVSS vector carries PR:N, so no prior authentication is needed beyond that install action. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation, though the integrity and availability impact is high (arbitrary file deletion) and the flaw crosses a privilege boundary on system-wide installs.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Path traversal in Flatpak's `flatpak build-init` command allows an attacker-controlled SDK container to write arbitrary files outside the developer's working directory when that developer builds against the SDK using both the `--writable-sdk` and `--sdk-extension` flags. The root cause (CWE-22) is that the SDK's declared extension-point `directory` value is resolved through a path helper that does not reject `..` components, so a malicious SDK can steer writes outside the intended build root. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a local, user-interaction-dependent action rather than the remote 9.8 originally submitted; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the attacker must convince the developer to consume a hostile SDK, which severely limits real-world exposure.
Message-filtering bypass in xdg-dbus-proxy before 0.1.9 lets a malicious or already-compromised sandboxed application - most notably a Flatpak app, but also deployments under frameworks such as Firejail - escape its confinement and execute arbitrary code on the host by attaching a forged reply serial number to non-reply D-Bus messages. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:P, with high confidentiality, integrity and availability impact scoped to the sandbox-escape boundary) and is rated a genuine high-priority sandbox-escape issue rather than a CVSS-inflated paper risk; the practical precondition is that an attacker must first get code running inside a sandbox that routes its session bus through the vulnerable proxy, typically by tricking a user into installing or launching a hostile or trojanized app. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; vendor-released patch: 0.1.9.
Path traversal in flatpak-builder 1.4.5 through 1.4.7 enables arbitrary host file exfiltration through license-files manifest exploitation. Attacker-crafted manifest with symlink manipulation bypasses g_file_get_relative_path() and g_file_query_file_type() validation, allowing reads outside source directory. Successful exploitation requires user interaction (processing malicious manifest) but grants unauthenticated remote attackers high confidentiality impact with no authentication required. Publicly available exploit code exists. CVSS 7.1 reflects network vector with user participation prerequisite.
Arbitrary file deletion in Flatpak versions prior to 1.16.4 allows sandboxed applications to delete files on the host system via path traversal during ld.so cache cleanup. The vulnerability stems from improper validation of application-controlled paths when removing outdated cache files, enabling applications to escape sandbox constraints and delete arbitrary host files. No active exploitation or public exploit code is confirmed at time of analysis, though the technical barrier is low given the CVSS vector shows network-accessible attack with low complexity and no authentication required.
Sandbox escape in Flatpak versions prior to 1.16.4 allows applications to access arbitrary host filesystem paths and achieve host-level code execution through symlink manipulation in portal sandbox-expose options. The vulnerability requires no authentication (CVSS:4.0 PR:N) and is exploitable over the network with low complexity. No confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the attack primitive is clearly documented in the vendor advisory.
Flatpak before 1.18.4 exposes OCI authentication tokens to other local users when a victim performs an authenticated download of an app or runtime from an OCI repository, allowing a co-located attacker to capture the token and potentially misuse it. The flaw affects multi-user Linux systems and was fixed in Flatpak 1.18.4; no public exploit code or active exploitation is known at this time, and the assessed impact is limited to information disclosure (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Flatpak versions prior to 1.18.4 export .desktop and D-Bus .service files from installed applications to the host without filtering their fields against an allowlist, enabling a malicious Flatpak app to cause denial of service or unintended interactions with host services. Exploitation is local and requires the victim to install a malicious app (from a Flatpak remote or sideloaded bundle); no public exploit code or active exploitation is identified in the available data. The vendor-released patch is Flatpak 1.18.4.
Incorrect permissions on temporary repository cache directories in Flatpak before 1.18.4 allow a local, unprivileged user to read data left behind in /var/tmp/flatpak-cache-* while another user's app or runtime is being downloaded from an OCI repository. Exploitation requires a pre-existing local account on a multi-user host and the transient cache directory to still exist before Flatpak cleans it up, and the result is low-confidentiality information disclosure only - no privilege escalation, code execution, or file modification is possible, and no public exploit identified at time of analysis. The same 1.18.4 release addresses several more serious sibling issues (CVE-2026-97023, CVE-2026-97024, CVE-2026-97025, CVE-2026-97027, CVE-2026-97029), so a single upgrade remediates all of them.
Symlink-following during ld.so cache regeneration in Flatpak before 1.18.1 lets a malicious sandboxed application replace its per-app ~/.var/app/$appid/.ld.so path with a symlink so that Flatpak's regenerate_ld_cache writes cache files at an arbitrary attacker-chosen location. The impact is limited to low-integrity file writes on the local host: the written filenames and content are generated by Flatpak and are not attacker-controlled, so this cannot deliver arbitrary code or leak data, and CVSS 3.1 is 4.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L per independent reassessment). Exploitation requires a user to have installed and run an untrusted Flatpak app from a non-trusted source; there is no public exploit code identified at time of analysis, and the vendor's own advisory characterizes it as hard to exploit.
Flatpak xdg-desktop-portal versions before 1.20.4 and 1.21.x before 1.21.1 allow any sandboxed Flatpak application to delete arbitrary files on the host system through a symlink race condition in the g_file_trash function. The vulnerability exploits insufficient validation of file paths during trash operations, enabling local privilege escalation from a confined container context to affect host files. CVSS severity is low (2.9) due to high attack complexity and local-only vector, but the impact affects all Flatpak users whose host system contains a vulnerable xdg-desktop-portal installation.
Policy parser vulnerability in xdg-dbus-proxy prior to 0.1.7 allows authenticated local users to bypass eavesdrop restrictions and intercept D-Bus messages by exploiting improper whitespace handling in policy rule parsing. The proxy fails to normalize eavesdrop policy directives, permitting attackers to craft malformed policies (e.g., eavesdrop ='true' with spacing variations) that evade the eavesdrop=true access control checks. No public exploit code has been identified at time of analysis.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 8.2), this vulnerability is no authentication required, low attack complexity.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.