Executive brief
Flatpak is a containerization system used to isolate and distribute desktop applications. A timing vulnerability in Flatpak's privileged installation process allows a local attacker to redirect files to arbitrary locations on the system, potentially exposing sensitive data or modifying critical application files before validation occurs.
Technical details
A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component, specifically in the Deploy() function. The vulnerability occurs because a privileged chmod operation executes before OSTree repository validation, creating a timing window where an attacker can manipulate symlinks to redirect to arbitrary files. An attacker with local access and low privileges can exploit this race condition during application deployment to achieve unauthorized file read/write access. The attack requires precise timing and does not need user interaction. A patch is expected from the Flatpak project.
Affected products
- Flatpak Flatpak
Timeline
- 2026-09-04: disclosed