Symlink traversal in Flatpak revokefs allows local root privilege escalation
Flatpak before 1.18.1 contains a symlink-traversal flaw (CWE-61) in the revokefs writer used by flatpak-system-helper to receive repository data from unprivileged callers: it rejected literal '..' path components but did not block traversal through symlinks. A malicious local user with an active session could open two revokefs sessions via the system helper, place a symlink in one pointing into the other's directory, and retain a file descriptor to modify files after they had been validated and imported. This enables tampering with ostree commit objects in the system repository after they passed signature verification, yielding root-controlled file writes to attacker-chosen paths and full local root privilege escalation (CVSS 3.1: 7.4, high; attack complexity is high and an active local session is required). Anyone running a vulnerable Flatpak build that uses the revokefs-backed system helper — common in mainstream Linux desktop distributions — is affected. No public proof of concept is known and there is no indication of exploitation in the wild.
What to do: Upgrade Flatpak to 1.18.1 or later (or apply your distribution's patched security package) and verify with 'flatpak --version'. Restrict interactive local accounts on multi-user desktops and kiosk-style shared systems, since exploitation requires an active local session. Watch for anomalous writes to /var/lib/flatpak ostree objects or unexpected setuid binaries owned by root following any local session activity on unpatched hosts.
| Flatpak project (freedesktop.org) Flatpak (revokefs writer / flatpak-system-helper) | before 1.18.1 |
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
MITRE assigned CVE-2026-96808 and CVE-2026-96807 to Flatpak flaws fixed in 1.18.1.
Simon McVittie reported on oss-security that MITRE assigned CVE identifiers for two Flatpak issues fixed in version 1.18.1. CVE-2026-96808 corresponds to GHSA-qrwq-7qwx-q9rp, and CVE-2026-96807 corresponds to GHSA-99wv-m8rp-g58x. The note does not describe impact or exploitation.