SB2026081128 - Multiple vulnerabilities in Flatpak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081128

SB2026081128 - Multiple vulnerabilities in Flatpak

Published: August 11, 2026

Security Bulletin ID SB2026081128
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 42% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite arbitrary files outside the working directory.

The vulnerability exists due to path traversal in flatpak build-init extension file copying when processing a malicious SDK container with crafted extension point metadata via --writable-sdk and --sdk-extension or extension copying options. A remote attacker can provide an SDK extension with a crafted directory path containing traversal sequences to overwrite arbitrary files outside the working directory.

Before copying, existing files at the traversed target path are deleted and replaced with the extension content.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to create files and directories outside the intended root directory.

The vulnerability exists due to improper input validation in the flatpak-system-helper DeployAppstream handling when processing a crafted architecture name in the \"arch\" parameter. A local user can supply a crafted architecture name to create files and directories outside the intended root directory.

Exploitation requires at least one OCI remote to be configured and an active local session.


3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass anti-downgrade checks and downgrade system apps or runtimes.

The vulnerability exists due to improper access control in the system helper RemoveLocalRef method when removing the remote ref of an app or runtime. A local user can remove the remote ref to bypass anti-downgrade checks and downgrade system apps or runtimes.

On a multi-user system, exploitation requires an active local login session and can expose other users of the same system to an older app version with unfixed vulnerabilities.


4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to path traversal in the revokefs writer when processing repository data from unprivileged callers via symlink traversal between revokefs sessions. A local user can create a symlink between two revokefs sessions and retain a file descriptor to tamper with validated commit data to escalate privileges.

Exploitation requires an active local session and access to operations permitted by the system helper.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in OCI archive extraction when extracting crafted OCI layer archives during install or update from an OCI remote. A remote attacker can serve a crafted OCI layer archive with an absolute hardlink target to disclose sensitive information.

System-wide installs running as root can expose sensitive host files such as /etc/shadow. Flatpak remotes using the default OSTree transport are not affected.


6) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the OCI delta stream parser when processing a crafted delta stream from a malicious OCI registry during installation or update. A remote attacker can supply a specially crafted OCI delta stream to execute arbitrary code.

Only 32-bit systems are practically exploitable. Flatpak remotes using the default OSTree transport are not affected.


7) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose filenames from arbitrary host directories to sandboxed applications.

The vulnerability exists due to path traversal in host-side extension file access when processing extension content directories controlled by an installed extension. A remote user can place symlinks pointing to arbitrary host paths to disclose filenames from arbitrary host directories to sandboxed applications.

The issue is triggered when Flatpak checks the .ref lock marker file and iterates merge_dirs directories during application launch.


8) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to mount extension content at unintended locations inside the sandbox.

The vulnerability exists due to path traversal in extension metadata fields when processing extension metadata. A remote user can supply absolute paths or .. components in metadata fields to mount extension content at unintended locations inside the sandbox.

Metadata fields involved include directory, subdir_suffix, add_ld_path, and merge_dirs, and exploitation can potentially override runtime directories.


9) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write attacker-controlled content to arbitrary locations on the host filesystem.

The vulnerability exists due to path traversal in extract_extra_data when extracting extra-data from a malicious or compromised Flatpak repository. A remote attacker can provide a repository containing a symlinked files entry to write attacker-controlled content to arbitrary locations on the host filesystem.

On system installs, the write occurs with root permissions.


10) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write attacker-controlled content to arbitrary locations on the host filesystem.

The vulnerability exists due to path traversal in extract_extra_data when handling extra-data source names from commit metadata. A remote attacker can supply a crafted extra-data name containing .. components to write attacker-controlled content to arbitrary locations on the host filesystem.

On system installs, the write occurs with root permissions.


11) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access arbitrary files on the host filesystem and potentially execute arbitrary code on the host.

The vulnerability exists due to improper link resolution in app data directory setup and bind mounts when creating and mounting attacker-controlled sandbox paths. A remote user can create a malicious symlink to redirect a bind-mounted directory to an arbitrary host location to access arbitrary files on the host filesystem and potentially execute arbitrary code on the host.

Exploitation requires a malicious sandboxed app.


12) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to write files with fixed names and fixed content outside of the sandbox.

The vulnerability exists due to improper link resolution in regenerate_ld_cache when handling a symlinked ~/.var/app/$appid/.ld.so path. A local user can replace ~/.var/app/$appid/.ld.so with a symlink to write files with fixed names and fixed content outside of the sandbox.

The filenames and file content are not attacker-controlled, which makes exploitation difficult.


Remediation

Install update from vendor's website.

References