Path traversal in Flatpak build-init SDK extensions writes files outside build directory
AI analysis
Flatpak's build tooling contains a path traversal flaw (CWE-22) in how SDK extension points are handled: when a developer runs `flatpak build-init --writable-sdk --sdk-extension` with a malicious or compromised SDK container, the extension point's `directory` field is resolved by a function that permits `..` traversal. This lets the SDK's author cause attacker-chosen files to be written outside the intended build working directory on the developer's machine. Because arbitrary files can be planted (for example into home-directory configuration), this can plausibly escalate to code execution in the developer's context during subsequent builds or logins. Only developers building with writable SDKs and extension points are exposed — end users who merely run installed Flatpak apps are not affected by this code path. No public proof-of-concept exists and no exploitation has been reported; a fix ships in Flatpak 1.18.1 per the release announcement.
What to do: Update Flatpak to 1.18.1 or your distribution's patched maintenance release. Only run build-init with writable SDKs from trusted sources (official freedesktop runtimes or reputable SDK providers), and inspect any SDK extension point declarations for `..` sequences before building. If you have built against third-party SDKs, audit your build machines for unexpected files created outside the build directory (e.g., in your home or git config) and rotate credentials used in those environments.
Affected
| Flatpak project (freedesktop.org) Flatpak | Affected version range not specified in the advisory; fix available in 1.18.1 per the Flatpak 1.18.1 release announcement |
Estimated exposure
niche≈ hundreds to low thousands of developer build environments worldwide — Flatpak itself is installed on millions of Linux desktops, but this flaw requires running the developer-only `flatpak build-init --writable-sdk --sdk-extension` command with a hostile SDK, and the pool of active Flatpak app…
Description
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.