CVE-2026-96276: Flatpak: flatpak: arbitrary write in host context via flatpak build-init
GHSA-8qxj-x646-phcm (https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm)
Impact: If a malicious SDK container declares an extension point with a crafted path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory.
Description: flatpak build-init with --sdk-extensions or --base-extensions copies extension files into the build directory. The target path comes from the directory key in the extension point metadata and is resolved using gfileresolverelativepath, which resolves .. components. A malicious extension with directory=../../<path> causes its files to be written outside the build tree. Before copying, the target path is cleaned with flatpakrmrf, so existing files at the traversed path are deleted and replaced with the extension's content.
Related to GHSA-fqx6-vh4p-42cg (CVE-2026-96275); solutions share code. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
Other sources
If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows .. traversal.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers who run flatpak build-init with both --writable-sdk and --sdk-extension against a malicious SDK container are exposed. The impact is an arbitrary file write in the host context outside the intended working directory.
What does an attacker need to exploit it?
An attacker needs to provide or induce use of an SDK container that declares an extension point with a crafted directory path. Exploitation also requires the developer to invoke flatpak build-init with --writable-sdk and --sdk-extension using that SDK.
Is a normal flatpak build-init invocation affected?
The described condition specifically requires use of both --writable-sdk and --sdk-extension. The available information does not indicate that invocations without those options are affected.
What can be done before a fix is available?
Do not use untrusted SDK containers with flatpak build-init when enabling --writable-sdk and --sdk-extension. Restrict SDK sources to trusted containers until the issue is remediated.