GHSA-cc2q-qc34-jprg: Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Q: Which installations are affected?

Flatpak versions prior to 1.16.4 are affected. The issue is in the Flatpak portal handling of sandbox-expose options.

Q: What does an attacker need to exploit this issue?

An attacker needs to control an application that can supply sandbox-expose paths, including paths implemented as app-controlled symlinks. The vulnerable behavior resolves those symlinks to arbitrary host paths and mounts the resulting host path into the sandbox.

Q: What is the practical impact of successful exploitation?

A malicious app can gain access to all host files. That access can be used as a primitive for code execution in the host context.

Q: What should be done to remediate the issue?

Upgrade Flatpak to version 1.16.4, which fixes the vulnerability.

Published Apr 7, 2026

Updated

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Affected Software

1 affected component

Flatpak Flatpak<1.16.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Flatpak to a version that resolves this vulnerability.
Fixed in 1.16.4

Event History

Apr 7, 2026

CVE Published

via OSV·09:27 PM

Data Sourced

via OSV·09:27 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Flatpak versions prior to 1.16.4 are affected. The issue is in the Flatpak portal handling of sandbox-expose options.

What does an attacker need to exploit this issue?

An attacker needs to control an application that can supply sandbox-expose paths, including paths implemented as app-controlled symlinks. The vulnerable behavior resolves those symlinks to arbitrary host paths and mounts the resulting host path into the sandbox.

What is the practical impact of successful exploitation?

A malicious app can gain access to all host files. That access can be used as a primitive for code execution in the host context.

What should be done to remediate the issue?

Upgrade Flatpak to version 1.16.4, which fixes the vulnerability.

GHSA-cc2q-qc34-jprg: Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What should be done to remediate the issue?