The vulnerability arises from an overly permissive Content Security Policy implemented by yelp-xsl, which allows attacker-controlled help content opened via the Flatpak OpenURI portal to bypass sandbox restrictions. By embedding malicious CSS stylesheets within structured SVG documents, a Flatpak app can cause Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This cross-boundary information disclosure affects Red Hat Enterprise Linux 8 and related CodeReady Linux Builder variants. The issue is a regression of a previously fixed vulnerability (CVE-2025-3155) and is fixed exclusively by security updates to the yelp package. Red Hat has released a security update (yelp-3.28.1-3.el8_10.2) that fully addresses the vulnerability. No fixes are required for yelp-xsl. The vulnerability does not require elevated privileges or user interaction beyond running the malicious Flatpak application.

The vulnerability allows a sandboxed Flatpak application to bypass intended sandbox isolation and disclose arbitrary user-readable files from the host system via the Yelp help browser. This results in unauthorized disclosure of sensitive information (confidentiality impact is high). There is no demonstrated impact on integrity or availability. The attack vector is local, requiring the attacker to run a malicious Flatpak application on the victim system. No privileges or user interaction are required beyond running the malicious app.

A security update to the yelp package is available and fully remediates this vulnerability. Red Hat advises all users of affected Red Hat Enterprise Linux 8 and related CodeReady Linux Builder products to apply the yelp security update (e.g., yelp-3.28.1-3.el8_10.2) as soon as possible. No additional updates to yelp-xsl are required. No other mitigations meet Red Hat's standards for usability or applicability. Systems are fully protected once the yelp update is applied.