CVE-2026-96282: Flatpak: flatpak: extension metadata path traversal file existence oracle
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
Other sources
GHSA-w69g-9x8j-7p8f (https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f)
Description: When Flatpak launches an application, it performs host-side file operations inside extension content directories to set up bind mounts and symlinks, using path-based APIs that follow symlinks without confinement. Since an extension's files directory is entirely controlled by the extension developer, a malicious extension can place symlinks pointing at arbitrary host paths. Flatpak follows symlinks in the extension content when checking for the .ref lock marker file and when iterating mergedirs directories; for mergedirs, the host-side directory listing is reflected into the sandbox as symlinks the application can enumerate, disclosing filenames from arbitrary host directories. Separately, extension metadata fields (directory, subdirsuffix, addldpath, mergedirs) were not validated for path traversal, allowing extension content to be mounted at unintended sandbox locations.
Mitigation: Avoid installing Flatpak extensions from untrusted sources; there is no configuration to disable extension processing without removing the extensions. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.1 - Compensating control
Avoid installing Flatpak extensions from untrusted sources.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that launch a Flatpak application with a malicious extension are exposed. The extension developer controls the extension files directory and can use symlinks there to target arbitrary host paths during Flatpak's host-side setup operations.
What does an attacker need to exploit it?
An attacker needs to provide a malicious Flatpak extension and have it used when Flatpak launches an application. No attacker privileges are required, but user interaction is required according to the supplied severity vector.
What information or access can the malicious extension obtain?
It can probe arbitrary host paths to determine whether files or directories exist. By abusing merge_dirs processing, it can cause host directory listings to be reflected into the sandbox as symlinks, allowing the sandboxed application to enumerate disclosed filenames.
Can extension content be mounted somewhere unintended?
Yes. Unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.