This vulnerability involves improper limitation of pathname to a restricted directory (CWE-22) in the Flatpak client/system-helper stack used by Red Hat Enterprise Linux 10. Specifically, the extract_extra_data() function allows a malicious or compromised Flatpak repository to write attacker-controlled content to arbitrary locations on the host filesystem. The issue combines two flaws: the 'files/extra' directory path is resolved following symlinks, and blob names from 'xa.extra-data-sources' are not sanitized against '..' path traversal sequences. On system installs, this write operation occurs with root privileges, enabling an attacker to overwrite or create critical files, potentially leading to full system compromise. The vulnerability requires no privileges on the victim host but does require user interaction to add or trust the malicious repository and initiate an install or update. Red Hat has assigned a CVSS 3.1 score of 8.8 (high severity) and published an advisory with a fix in Flatpak version 1.18.1.

Successful exploitation allows an attacker controlling a Flatpak repository to write arbitrary files anywhere on the host filesystem with root privileges during system-wide installs. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The attacker can overwrite critical system files, execute unauthorized code, read sensitive data, or cause denial of service by corrupting essential files. No privileges on the victim host are required, but user interaction is needed to trust and install from the malicious repository.

A fix is available in Flatpak version 1.18.1. Users should upgrade to this version or later. Additionally, avoid installing Flatpak extensions from untrusted or unknown sources to prevent exposure to malicious repositories. Red Hat's advisory provides detailed guidance and should be consulted for the latest remediation status.