Skip to content
OpenAdvisories
High ALAS2023-2026-1601 2 CVEs

Important: flatpak security update (Amazon Linux 2023)

Published Apr 27, 2026 · Updated Apr 30, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34079: Arbitrary file deletion on the host filesystem in Flatpak before 1.16.4. The caching for ld.so removes outdated cache files without properly checking that the app-controlled path to the outdated cache is in the cache directory, allowing Flatpak applications to delete arbitrary files on the host. CVE-2026-34078: A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, giving apps access to all host files and enabling code execution in the host context.

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2023 flatpak 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-debuginfo 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-debugsource 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-devel 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-libs 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-libs-debuginfo 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-selinux 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-session-helper 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-session-helper-debuginfo 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-tests 0:1.16.6-1.amzn2023
Amazon Linux · 2023 flatpak-tests-debuginfo 0:1.16.6-1.amzn2023

Vulnerabilities 2

  • Critical 9.3
    CVE-2026-34078

    Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

    Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path i…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-34079

    Flatpak affected by arbitrary file deletion on the host filesystem

    Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatp…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-34078.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-34079.html