A flaw was found in bubblewrap. During sandbox setup the host filesystem is mounted at /oldroot and the sandboxed root is mounted at /newroot. When bubblewrap creates a file or directory under /newroot, it can follow a parent symlink that points at /oldroot, causing that object to be created on the host instead of inside the sandbox. This occurs during setup, before any sandboxed process is running. Created files use the uid and gid of the user that launched bubblewrap, which is typically unprivileged. The issue affects Flatpak when a malicious or compromised application image is used, and can affect other frameworks that create files on untrusted content with bubblewrap. This vulnerability is tracked by upstream as GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0 by resolving paths with openat2 and RESOLVEINROOT.

A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.

A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.OpenURI portal interface to pass crafted help layout files (ghelp:// or mallard extensions). Because the system portal processes this request silently without requiring user interaction, host-level Yelp is automatically invoked to parse the file outside the application container. The attacker-controlled layout leverages local XML inclusions to load arbitrary host-level files into memory, which are subsequently exfiltrated out-of-band to a remote server using a background CSS url() query embedded inside a structured SVG document.

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.