REDHAT-BUG-2539416: High severity Flatpak Flatpak vulnerability

Published Sep 23, 2026
·
Updated

GHSA-fqx6-vh4p-42cg (https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg)

Impact: A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem. On system installs, the write happens as root.

Description: There are two vulnerabilities in extractextradata. It resolves files/extra inside the checked-out commit tree using GFile path operations, which follow symlinks. If the files entry in the OSTree commit is a symlink (e.g., files -> /tmp), the downloaded extra-data blobs are written at the symlink target instead. Additionally, extractextradata writes downloaded blobs to files/extra/<name> where <name> comes from xa.extra-data-sources in the commit metadata; gfilegetchild resolves .. components, so a name like ../metadata escapes the extra/ directory.

Fixed in 1.18.1 (backports available for 1.16.x). Found by @swick after investigating a report from AISLE in cooperation with Red Hat.

Affected Software

1 affected component
Flatpak Flatpak<1.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Flatpak to a version that resolves this vulnerability.

    Fixed in 1.18.1

Event History

Sep 23, 2026
Data Sourced
via Red Hat·02:01 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Systems that install or update applications from a malicious or compromised Flatpak repository are exposed. For system-wide installs, the unintended file write occurs with root privileges.

2

What does an attacker need to exploit it?

The attacker needs control of repository content, including an OSTree commit with a symlinked files entry or crafted xa.extra-data-sources metadata. They can use symlink traversal or ../ path components to cause extra-data blobs to be written outside the intended files/extra directory.

3

Which versions contain a fix?

The issue is fixed in Flatpak 1.18.1. Backports are available for the 1.16.x series.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203