Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-libs | May 31, 2026 | May 28, 2026 |
| Alpine Linux | — | Upgrade flatpak | Apr 9, 2026 | Apr 7, 2026 |
| Amazon_linux_2023 | — | Upgrade flatpakUpgrade flatpak-libs-debuginfoUpgrade flatpak-testsUpgrade flatpak-debugsourceUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-develUpgrade flatpak-selinuxUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debuginfo | May 4, 2026 | Apr 7, 2026 |
| Debian | — | Upgrade flatpak | Apr 23, 2026 | Apr 23, 2026 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Aug 16, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade flatpakUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-devel | Jun 1, 2026 | Apr 7, 2026 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-builderUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-debugsourceUpgrade flatpak-tests-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helper | Jun 3, 2026 | Apr 7, 2026 |
| Rocky_linux | — | Upgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-debuginfoUpgrade flatpak-libs | Jun 1, 2026 | May 29, 2026 |
| Ubuntu | — | Upgrade libflatpak0 (Ubuntu Pro)Upgrade flatpak (Ubuntu Pro) | Sep 14, 2026 | Sep 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub