CVE-2026-87766: Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
A flaw was found in bubblewrap. During sandbox setup the host filesystem is mounted at /oldroot and the sandboxed root is mounted at /newroot. When bubblewrap creates a file or directory under /newroot, it can follow a parent symlink that points at /oldroot, causing that object to be created on the host instead of inside the sandbox. This occurs during setup, before any sandboxed process is running. Created files use the uid and gid of the user that launched bubblewrap, which is typically unprivileged. The issue affects Flatpak when a malicious or compromised application image is used, and can affect other frameworks that create files on untrusted content with bubblewrap. This vulnerability is tracked by upstream as GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0 by resolving paths with openat2 and RESOLVEINROOT.
Other sources
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bubblewrapto a version that resolves this vulnerability.Fixed in 0.12.0Patch GHSA-pxhw-h44j-8pfx
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Flatpak is affected when a malicious or compromised application image is used. Other frameworks may be affected if they use bubblewrap to create files on untrusted content during sandbox setup.
What does an attacker need to exploit it?
The attacker needs control of untrusted content that causes bubblewrap to create a file or directory beneath the new sandbox root through a parent symlink pointing to /oldroot. Exploitation occurs during setup, before a sandboxed process runs.
What access do writes outside the sandbox have?
Files and directories created outside the sandbox use the UID and GID of the user who launched bubblewrap, which is typically an unprivileged user. The issue can therefore write attacker-chosen host paths with that launcher's permissions.
What version contains the fix?
The issue is fixed in bubblewrap 0.12.0. The fix resolves paths using openat2 with RESOLVE_IN_ROOT.