REDHAT-BUG-2539422: Path Traversal
GHSA-w69g-9x8j-7p8f (https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f)
Description: When Flatpak launches an application, it performs host-side file operations inside extension content directories to set up bind mounts and symlinks, using path-based APIs that follow symlinks without confinement. Since an extension's files directory is entirely controlled by the extension developer, a malicious extension can place symlinks pointing at arbitrary host paths. Flatpak follows symlinks in the extension content when checking for the .ref lock marker file and when iterating mergedirs directories; for mergedirs, the host-side directory listing is reflected into the sandbox as symlinks the application can enumerate, disclosing filenames from arbitrary host directories. Separately, extension metadata fields (directory, subdirsuffix, addldpath, mergedirs) were not validated for path traversal, allowing extension content to be mounted at unintended sandbox locations.
Mitigation: Avoid installing Flatpak extensions from untrusted sources; there is no configuration to disable extension processing without removing the extensions. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.1Patch GHSA-w69g-9x8j-7p8f - Compensating control
Avoid installing Flatpak extensions from untrusted sources.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that install Flatpak extensions from untrusted sources are exposed. The extension developer controls the relevant extension files and metadata.
What must an attacker do to exploit it?
An attacker needs to provide a malicious Flatpak extension that contains symlinks to host paths or uses traversal in extension metadata fields. When Flatpak processes that extension, it can follow those paths during bind-mount, symlink, lock-marker, or merge-directory handling.
What information or access could be affected?
A malicious extension can cause host-side path handling outside the intended extension directory. In the merge_dirs case, directory listings can be reflected into the application sandbox as symlinks, allowing the application to enumerate filenames from arbitrary host directories.
Is there a configuration-based workaround if updates cannot be installed immediately?
No configuration is available to disable extension processing while keeping the extensions installed. The stated mitigation is to avoid untrusted extensions or remove the extensions.
What fixed version is identified?
The issue is fixed in Flatpak 1.18.1, with backports available.