On Tue, 11 Aug 2026 at 17:38:45 +0100, Simon McVittie wrote:
Today's Flatpak 1.18.1 release fixes multiple vulnerabilities.
We've eventually been able to obtain CVE IDs for most of these (two are
still pending). I requested CVE IDs from Github before we unembargoed,
but we haven't received any response in most cases, so we fell back to
requesting CVE IDs from other CNAs (variously MITRE and Red Hat).
* Fix sandbox escape with full host filesystem read/write access via symlink
attack on app data directories
(https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj,
thanks to Ee Yang)
CVE-2026-90616
* Fix local root privilege escalation via revokefs symlink path traversal and
commit tampering
(https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp,
thanks to Ee Yang)
CVE ID requested from MITRE, pending request ref. CAN-2026-2052453
* Fix arbitrary root write via symlink and path traversal in extra-data
extraction
(https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg,
thanks to AISLE in cooperation with Red Hat)
CVE-2026-96275
* Fix arbitrary root write via path traversal in `flatpak build-init`
(https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm,
thanks to Sebastian Wick)
CVE-2026-96276
* Fix arbitrary host file read via hardlink path traversal in OCI archive
extraction
(https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg,
thanks to Sebastian Wick)
CVE-2026-96279
* Fix path traversal via unvalidated architecture parameter in DeployAppstream
(https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x,
thanks to Yehia Ali Mohamed Ezzat)
CVE-2026-92162
* Fix buffer overflow in OCI delta stream path names on 32-bit systems
(https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc,
thanks to Sebastian Wick)
CVE-2026-96280
* Fix fixed-filename writes to arbitrary locations via symlink attack on .ld.so
(https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x,
thanks to Sebastian Wick)
CVE ID requested from MITRE, pending request ref. CAN-2026-2052452
* Fix extension metadata path traversal allowing host filesystem probing and
unintended mount locations
(https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f,
thanks to Sebastian Wick)
CVE-2026-96282
* Fix anti-downgrade bypass allowing unprivileged users to downgrade system
apps
(https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5,
thanks to BreachX Zero Day Labs)
CVE-2026-96281
There is also a CVE ID that has been issued by Red Hat for a backported
Flatpak version in RHEL, CVE-2026-76925. Based on discussion with the
Debian and Red Hat security teams, it seems that this is intended to be
RHEL-specific (possibly related to one of the upstream vulnerabilities
fixed in 1.18.1, but with different exploitation steps) and is not
applicable to upstream Flatpak.
For completeness, we've also obtained CVE IDs for the two lower-severity
issues that were fixed in 1.16.4:
* Arbitrary read access to files readable by the flatpak or _flatpak
system user
(https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc)
is CVE-2026-96284
* Ability to prevent another user's flatpak-system-helper pull from
being cancelled
(https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg)
is CVE-2026-96283
I hope these will help vendors to keep track of vulnerability/fix
status.
smcv
