Summary
It was discovered that Flatpak did not properly validate paths in
sandbox-expose options. A malicious or compromised Flatpak app could
use app-controlled symlinks to access arbitrary host files and gain
code execution in the host context. This issue was addressed in Ubuntu
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-34078)
It was discovered that Flatpak did not properly validate paths when
removing outdated ld.so cache files. A malicious or compromised Flatpak
app could use this issue to delete arbitrary files on the host.
(CVE-2026-34079)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | flatpak | 1.0.9-0ubuntu0.4+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | flatpak | 1.6.5-0ubuntu0.5+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | flatpak | 1.12.7-1ubuntu0.1+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | flatpak | 1.14.6-1ubuntu0.1+esm1 |
Vulnerabilities 2
-
Critical 9.3
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path i…
-
High 8.7
Flatpak affected by arbitrary file deletion on the host filesystem
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatp…