GHSA-99wv-m8rp-g58x: Medium severity Flatpak Flatpak vulnerability

Q: Which systems are exposed to this issue?

Systems running Flatpak versions before 1.18.1 are affected when a malicious app can run in a Flatpak sandbox. The vulnerable path is within the affected app's ~/.var/app/$appid/ directory.

Q: What does an attacker need to exploit this?

An attacker needs to get a malicious application running in a Flatpak sandbox and replace that app's .ld.so path with a symlink. No additional privileges or user interaction are indicated.

Q: How practical is exploitation?

Exploitation is described as difficult because the attacker cannot control the filenames or contents written by regenerate_ld_cache. The impact is limited to arbitrary-location writes of those fixed files.

Q: What should be done if an immediate update is not possible?

The provided information does not specify a mitigation other than updating. Reducing exposure means avoiding untrusted or malicious Flatpak applications until Flatpak can be updated to 1.18.1 or later.

Published Sep 23, 2026

Updated

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.

Affected Software

1 affected component

Flatpak Flatpak<1.18.1

Event History

Sep 23, 2026

CVE Published

via OSV·04:54 PM

Data Sourced

via OSV·04:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running Flatpak versions before 1.18.1 are affected when a malicious app can run in a Flatpak sandbox. The vulnerable path is within the affected app's ~/.var/app/$appid/ directory.

What does an attacker need to exploit this?

An attacker needs to get a malicious application running in a Flatpak sandbox and replace that app's .ld.so path with a symlink. No additional privileges or user interaction are indicated.

How practical is exploitation?

Exploitation is described as difficult because the attacker cannot control the filenames or contents written by regenerate_ld_cache. The impact is limited to arbitrary-location writes of those fixed files.

What should be done if an immediate update is not possible?

The provided information does not specify a mitigation other than updating. Reducing exposure means avoiding untrusted or malicious Flatpak applications until Flatpak can be updated to 1.18.1 or later.

GHSA-99wv-m8rp-g58x: Medium severity Flatpak Flatpak vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit this?

How practical is exploitation?

What should be done if an immediate update is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit this?

How practical is exploitation?

What should be done if an immediate update is not possible?