CVE-2026-96276

Flatpak's build tooling contains a path traversal flaw (CWE-22) in how SDK extension points are handled: when a developer runs `flatpak build-init --writable-sdk --sdk-extension` with a malicious or compromised SDK container, the extension point's `directory` field is resolved by a function that permits `..` traversal. This lets the SDK's author cause attacker-chosen files to be written outside the intended build working directory on the developer's machine. Because arbitrary files can be planted (for example into home-directory configuration), this can plausibly escalate to code execution in the developer's context during subsequent builds or logins. Only developers building with writable SDKs and extension points are exposed — end users who merely run installed Flatpak apps are not affected by this code path. No public proof-of-concept exists and no exploitation has been reported; a fix ships in Flatpak 1.18.1 per the release announcement.

What to do: Update Flatpak to 1.18.1 or your distribution's patched maintenance release. Only run build-init with writable SDKs from trusted sources (official freedesktop runtimes or reputable SDK providers), and inspect any SDK extension point declarations for `..` sequences before building. If you have built against third-party SDKs, audit your build machines for unexpected files created outside the build directory (e.g., in your home or git config) and rotate credentials used in those environments.