A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-devel | Oct 12, 2026 | Oct 12, 2026 |
| Amazon Linux Ami 2 | — | Upgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-builder | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade flatpak-libs-debuginfoUpgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-selinuxUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-tests-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-tests | Oct 13, 2026 | Sep 23, 2026 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-session-helper-debuginfoNo solution existsUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-tests-debuginfo | Sep 25, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-libs-debuginfoUpgrade flatpak-develUpgrade flatpak | Oct 15, 2026 | Oct 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub