Re: Flatpak 1.18.1 fixes multiple vulnerabilities

Flatpak before 1.18.1 contains a symlink-traversal flaw (CWE-61) in the revokefs writer used by flatpak-system-helper to receive repository data from unprivileged callers: it rejected literal '..' path components but did not block traversal through symlinks. A malicious local user with an active session could open two revokefs sessions via the system helper, place a symlink in one pointing into the other's directory, and retain a file descriptor to modify files after they had been validated and imported. This enables tampering with ostree commit objects in the system repository after they passed signature verification, yielding root-controlled file writes to attacker-chosen paths and full local root privilege escalation (CVSS 3.1: 7.4, high; attack complexity is high and an active local session is required). Anyone running a vulnerable Flatpak build that uses the revokefs-backed system helper — common in mainstream Linux desktop distributions — is affected. No public proof of concept is known and there is no indication of exploitation in the wild.