https://seclists.org/oss-sec/2026/q3/965: Flatpak 1.18.4 fixes multiple security vulnerabilities

Q: Which Flatpak installations should be treated as affected?

All Flatpak releases older than 1.18.4 should be assumed vulnerable.

Q: What must an attacker do to trigger the arbitrary-file overwrite or deletion issues?

The attacker needs a malicious app to be installed. The reported impacts include privileged overwrite of arbitrary files with an empty file or a symlink, and privileged deletion of arbitrary files.

Q: When is an authentication token at risk of exposure to other users?

The token exposure issue applies when downloading apps or runtimes from an OCI repository that requires authentication. Earlier versions could make that authentication token visible to other users.

Q: What local filesystem area is relevant to the temporary-repository permission issue?

The affected temporary repository directories are named /var/tmp/flatpak-cache-*. Version 1.18.4 restricts permissions on those directories.

Published Sep 28, 2026

Updated

Affected Software

1 affected component

Flatpak Flatpak<1.18.4

Frequently Asked Questions

Which Flatpak installations should be treated as affected?

All Flatpak releases older than 1.18.4 should be assumed vulnerable.

What must an attacker do to trigger the arbitrary-file overwrite or deletion issues?

The attacker needs a malicious app to be installed. The reported impacts include privileged overwrite of arbitrary files with an empty file or a symlink, and privileged deletion of arbitrary files.

When is an authentication token at risk of exposure to other users?

The token exposure issue applies when downloading apps or runtimes from an OCI repository that requires authentication. Earlier versions could make that authentication token visible to other users.

What local filesystem area is relevant to the temporary-repository permission issue?