CVE-2026-90616

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1

Description A malicious sandboxed application can obtain arbitrary read and write access to files on the host, potentially leading to arbitrary code execution. This occurs because Flatpak creates app data directories (such as /var/cache, /var/data, /var/config, and /var/tmp) during sandbox launch where certain path components are attacker-controlled. Due to missing symlink protection, these directories can be redirected. Flatpak bind-mounts these paths (for example, /home/user/.var/app/APP ID/cache/tmp) by passing them to bwrap --bind SRC DST. Since bwrap passes the path to the kernel, which follows symlinks, a malicious symlink can point to arbitrary host locations, making them accessible inside the sandbox.

Recommendations Update to version 1.18.1 or later.