Executive brief
Flatpak is a system used on Linux to run applications in a secure, isolated environment (a sandbox). A flaw in how it manages temporary library files allows a malicious application to bypass these security boundaries and delete any file on the user's computer. This could lead to data loss or system instability if critical system files are removed.
Technical details
A path traversal vulnerability (CWE-22) exists in Flatpak's ld.so caching mechanism. The software fails to properly validate that application-controlled paths for outdated cache files reside within the designated cache directory before deletion. An attacker-controlled Flatpak application can exploit this lack of validation to issue deletion commands for arbitrary files on the host filesystem, effectively escaping the sandbox. The vulnerability is present in versions prior to 1.16.4 and is resolved in version 1.16.4 and later.
Affected products
- Flatpak Flatpak < 1.16.4
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version 1.16.4