Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpakUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-devel | May 31, 2026 | May 28, 2026 |
| Alpine Linux | — | Upgrade flatpak | Apr 9, 2026 | Apr 7, 2026 |
| Amazon_linux_2023 | — | Upgrade flatpakUpgrade flatpak-tests-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-testsUpgrade flatpak-libs-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-devel | May 4, 2026 | Apr 7, 2026 |
| Debian | — | Upgrade flatpak | Apr 23, 2026 | Apr 23, 2026 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Aug 16, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-selinux | Jun 1, 2026 | Apr 7, 2026 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-builderUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-debugsourceUpgrade flatpak-tests-debuginfoUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debuginfo | Jun 3, 2026 | Apr 7, 2026 |
| Rocky_linux | — | Upgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helper | Jun 1, 2026 | May 29, 2026 |
| Ubuntu | — | Upgrade flatpak (Ubuntu Pro)Upgrade libflatpak0 (Ubuntu Pro) | Sep 14, 2026 | Sep 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub