Flatpak 1.18.4 fixes multiple security vulnerabilities
Flatpak 1.18.4 fixes multiple security vulnerabilities and hardens against symlink traversal issues tracked as CVE-2026-97023 and CVE-2026-97024.
22
Vulnerability4 · 3 reads
CVE-2026-97024
Flatpak path traversal can empty or symlink host files
- CVSS 3.1
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A path traversal flaw in how Flatpak handles the files/etc directory during app deployment lets a malicious Flatpak app empty certain host files, such as passwd, group, machine-id, or resolv.conf, or replace them with a symlink. It is triggered when a user installs or upgrades the crafted app; on system-wide installations the write is performed as root. The impact is integrity and availability rather than confidentiality: those files can be wiped or redirected, which can disrupt authentication, identity, or name resolution. Linux users and devices that deploy Flatpak apps, including common desktop distributions and Steam Deck, are affected if they run a vulnerable release. No public proof-of-concept is known and the issue is not listed in CISA KEV.
What to do: Upgrade Flatpak to 1.18.4 or later, including on systems that use system-wide installs. Until then, install or upgrade apps only from trusted remotes. If an untrusted app was installed or upgraded on an unpatched host, check files such as passwd, group, machine-id, and resolv.conf for unexpected emptying or replacement by a symlink.
| Product | Affected |
|---|---|
| Flatpak project Flatpak | Versions before 1.18.4 (1.18.4 reported to fix the issue; exact vulnerable range not stated in the CVE data) |
Estimated exposure
massmillions of Linux desktops and devices that install Flatpak apps — Estimate from deployment patterns: Flatpak is commonly used on desktop Linux distributions and ships on Steam Deck, whose sales are publicly reported in the millions; no precise install census is in the CVE data.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
- Weakness
- CWE-61
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H