CVE-2026-76925: Flatpak: flatpak: toctou race condition allows symlink redirection
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy() function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Other sources
TOCTOU race in org.freedesktop.Flatpak.SystemHelper — privileged chmod runs before OSTree repo validation in Deploy(), allowing symlink redirection to arbitrary files.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/flatpakto a version that resolves this vulnerability.Fixed in 1.14.10-1~deb12u2Fixed in 1.16.6-1~deb13u2Fixed in 1.18.2-1Fixed in 1.18.3-1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs local access and low privileges. Exploitation also requires winning a high-complexity timing race; no user interaction is required.
Which component is involved in the vulnerable operation?
The issue is in the org.freedesktop.Flatpak.SystemHelper component, specifically during the Deploy() function. A privileged chmod operation occurs before OSTree repository validation.
What could successful exploitation allow?
An attacker may redirect symlinks to arbitrary files during the race window. This can result in unauthorized file manipulation or information disclosure.