Sebastian Wick

**Name of the Vulnerable Software and Affected Versions** Flatpak versions prior to 1.18.4 **Description** A path traversal issue exists in the way Flatpak handles the `files/etc` directory during app deployment. This allows a malicious application to empty or replace critical host system files, such as `passwd`, `group`, `machine-id`, or `resolv.conf`, with a symlink during installation or upgrade. In system-wide installations, these write operations are performed with root privileges, which can lead to a loss of system access. **Recommendations** Update to Flatpak version 1.18.4 or later. Avoid installing applications from untrusted publishers for system-wide installations.

**Name of the Vulnerable Software and Affected Versions** Flatpak (affected versions not specified) **Description** A malicious OCI registry can hardlink arbitrary host files into the extraction directory during the installation or update of a Flatpak application from an OCI remote. This allows for the disclosure of arbitrary host file contents. In the case of system-wide installations running as root, this could include sensitive files such as `/etc/shadow`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flatpak (affected versions not specified) **Description** A malicious extension can probe the host filesystem to determine the existence of files and directories at arbitrary paths. This allows host directory listings to be disclosed to sandboxed applications utilizing the extension. Furthermore, unvalidated extension metadata can lead to extension content being mounted at unintended locations within the sandbox. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.