Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
CVSS Details
- CVSS 4.0 Base Score: 9.3 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-selinux | May 31, 2026 | May 28, 2026 |
| Alpine Linux | — | Upgrade flatpak | Apr 9, 2026 | Apr 7, 2026 |
| Amazon Linux Ami 2 | — | Upgrade flatpak-builderUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-debuginfoUpgrade flatpak-libs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade flatpak-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpak-testsUpgrade flatpak-libs-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak | May 4, 2026 | Apr 7, 2026 |
| Debian | — | Upgrade flatpak | Apr 23, 2026 | Apr 23, 2026 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Aug 16, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-selinuxUpgrade flatpak-libsUpgrade flatpak | Jun 1, 2026 | Apr 7, 2026 |
| Redhat_linux | — | Upgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-builderUpgrade flatpak-debugsourceUpgrade flatpakUpgrade flatpak-debuginfoUpgrade flatpak-tests-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfo | Jun 3, 2026 | Apr 7, 2026 |
| Rocky_linux | — | Upgrade flatpak-session-helper-debuginfoUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpak-develUpgrade flatpak-libs-debuginfo | Jun 1, 2026 | May 29, 2026 |
| Ubuntu | — | Upgrade libflatpak0 (Ubuntu Pro)Upgrade flatpak (Ubuntu Pro) | Sep 14, 2026 | Sep 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub