Description

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-12T20:16:30.957Z",
  "pubdate": "2026-09-12T20:16:30.957Z",
  "executiveSummary": "This vulnerability involves a critical sandbox escape in Flatpak versions prior to 1.18.1, allowing a malicious sandboxed application to gain arbitrary read and write access to the host filesystem. The flaw stems from insufficient validation of file paths during the sandbox initialization process, specifically when creating and bind-mounting application data directories.\nThe vulnerability allows a malicious application to bypass existing security boundaries by exploiting a lack of symlink protection within the bwrap (Bubblewrap) integration. By controlling components of path directories, an attacker can coerce the host kernel into following arbitrary symlinks during the bind-mount operation. This effectively maps sensitive host files or directories into the sandboxed environment with read/write privileges.\nThe impact of this vulnerability is severe, as it permits full host filesystem compromise, facilitating privilege escalation and arbitrary code execution on the underlying host system. It represents a significant failure in container isolation, independent of CVE-2026-76925. Successful exploitation requires an attacker to possess the ability to execute code within a sandboxed Flatpak environment, which is the baseline requirement for this type of container escape.",
  "technicalDetails": "The root cause of this vulnerability lies in the race-prone and insecure handling of directory path construction during Flatpak sandbox initialization. Upon every application launch, Flatpak attempts to materialize necessary data directories—such as /var/cache, /var/data, /var/config, and /var/tmp—within the sandbox environment. In certain configurations, the paths leading to these directories contain components that are directly controllable by the sandboxed application.\nThe vulnerability manifests during the execution of bwrap (Bubblewrap), the low-level sandboxing tool utilized by Flatpak. When Flatpak invokes bwrap, it passes source paths (SRC) to be bind-mounted into the destination (DST) inside the sandbox. These paths, such as /home/user/.var/app/APP_ID/cache/tmp, are processed by the Linux kernel. Because Flatpak fails to implement adequate symlink protection prior to passing these paths to the kernel, the mount operation follows symlinks encountered within the directory structure.\nAn attacker can exploit this by replacing directory components within their controlled application data space with symbolic links pointing to arbitrary locations on the host filesystem (e.g., /etc/shadow or other sensitive configuration files). When the Flatpak runner executes and invokes bwrap to bind-mount these paths, the kernel resolves the malicious symlinks, effectively mounting the target host directories into the sandboxed container. By placing a symlink at a location Flatpak expects to be a standard directory, the attacker ensures that the sensitive host path is mapped into the sandbox, granting the malicious process read and write access to the hijacked resource.\nThis bypasses the intended filesystem isolation constraints, as the sandbox security policy is rendered ineffective against resources that have been explicitly mounted into the container via this redirection mechanism. Once the attacker has established read/write access to critical host files, post-exploitation impact includes the modification of system binaries, persistent service deployment, or the extraction of sensitive host credentials, ultimately leading to full host code execution."
}