CVE-2026-76925

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure. TOCTOU is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.