CVE-2026-96275: Flatpak: flatpak: arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata(). On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob names from xa.extra-data-sources are not sanitized against .. traversal.
Other sources
GHSA-fqx6-vh4p-42cg (https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg)
Impact: A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem. On system installs, the write happens as root.
Description: There are two vulnerabilities in extractextradata. It resolves files/extra inside the checked-out commit tree using GFile path operations, which follow symlinks. If the files entry in the OSTree commit is a symlink (e.g., files -> /tmp), the downloaded extra-data blobs are written at the symlink target instead. Additionally, extractextradata writes downloaded blobs to files/extra/<name> where <name> comes from xa.extra-data-sources in the commit metadata; gfilegetchild resolves .. components, so a name like ../metadata escapes the extra/ directory.
Fixed in 1.18.1 (backports available for 1.16.x). Found by @swick after investigating a report from AISLE in cooperation with Red Hat.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that install content from a malicious or compromised Flatpak repository are exposed. System-wide installs are particularly severe because the arbitrary write occurs as root.
What must an attacker control to exploit it?
The attacker needs control of repository content or metadata used during extra-data extraction. Exploitation relies on a symlinked files entry in the OSTree commit and/or traversal sequences such as .. in xa.extra-data-sources blob names.
What filesystem locations can be affected?
Attacker-controlled content can be written to arbitrary host filesystem locations. A files symlink can redirect writes outside the checked-out commit tree, while .. components in blob names can traverse outside files/extra.