Re: Flatpak 1.18.1 fixes multiple vulnerabilities

Flatpak versions before 1.18.1 fail to apply symlink protection when creating per-app data directories such as /var/cache, /var/data, /var/config, and /var/tmp inside each sandbox on every app launch. Because components of the host-side mount path (e.g., ~/.var/app/APP_ID/cache/tmp) are attacker-controlled, a malicious sandboxed app can plant symlinks that redirect where these directories are bind-mounted. The path is passed through bwrap --bind to the kernel, which follows symlinks, so the attacker-chosen target on the host becomes mounted inside the sandbox. This yields arbitrary file read and write access on the host, which can be escalated to arbitrary code execution outside the sandbox (CVSS 3.1: 7.4, CWE-61; a distinct issue from CVE-2026-76925). Any Linux system running Flatpak before 1.18.1 is affected, but exploitation requires the victim to have installed the attacker's malicious Flatpak app; no public PoC, KEV listing, or in-the-wild exploitation is known.

Do: Upgrade to Flatpak 1.18.1 or later as soon as your distribution ships it, applying distro security backports where 1.18.1 is not yet packaged. Until patched, restrict installs to trusted remotes and verified Flathub publishers and remove any Flatpak apps from unverified sources. Inspect ~/.var/app/APP_ID/ directories for unexpected symlinks pointing outside the app's data tree, which would indicate a malicious app attempting this technique.

CVE-2026-96275 is a path traversal vulnerability in Flatpak's extract_extra_data() function that allows writing attacker-controlled content to arbitrary locations on the host filesystem. The flaw is triggered when processing a malicious or compromised Flatpak repository that uses specially crafted `files/extra` paths (via symlinks) and `xa.extra-data-sources` blob names containing `..` traversal sequences. On system-wide Flatpak installations, this write operation occurs with root privileges, leading to a complete system compromise. The vulnerability affects all Flatpak versions prior to the fix in 1.18.1, and there are no known public exploits or in-the-wild exploitation as of the advisory.

Do: Upgrade to Flatpak version 1.18.1 or later, as this version contains the fix for the path traversal vulnerability. Users should only install Flatpak applications from trusted repositories to avoid exposure to malicious repository definitions. System administrators should check for any unauthorized or suspicious Flatpak repositories configured on their hosts.

Flatpak's build tooling contains a path traversal flaw (CWE-22) in how SDK extension points are handled: when a developer runs `flatpak build-init --writable-sdk --sdk-extension` with a malicious or compromised SDK container, the extension point's `directory` field is resolved by a function that permits `..` traversal. This lets the SDK's author cause attacker-chosen files to be written outside the intended build working directory on the developer's machine. Because arbitrary files can be planted (for example into home-directory configuration), this can plausibly escalate to code execution in the developer's context during subsequent builds or logins. Only developers building with writable SDKs and extension points are exposed — end users who merely run installed Flatpak apps are not affected by this code path. No public proof-of-concept exists and no exploitation has been reported; a fix ships in Flatpak 1.18.1 per the release announcement.

Do: Update Flatpak to 1.18.1 or your distribution's patched maintenance release. Only run build-init with writable SDKs from trusted sources (official freedesktop runtimes or reputable SDK providers), and inspect any SDK extension point declarations for `..` sequences before building. If you have built against third-party SDKs, audit your build machines for unexpected files created outside the build directory (e.g., in your home or git config) and rotate credentials used in those environments.