In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to… (CVE-2026-90616)
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.
AI Analysis
Technical Summary
In Flatpak versions prior to 1.18.1, a sandboxed application can exploit missing symlink protection in certain app data directories (such as /var/cache, /var/data, /var/config, and /var/tmp) created on each app launch. These directories may include attacker-controlled components, allowing malicious symlinks to redirect bind mounts to arbitrary host filesystem locations. Since Flatpak uses bubblewrap (bwrap) to bind these paths, and the kernel follows symlinks, this results in the sandboxed app obtaining arbitrary read and write access to host files. This vulnerability can be escalated to arbitrary code execution on the host. This is a separate issue from CVE-2026-76925.
Potential Impact
A malicious sandboxed application can bypass intended sandbox restrictions to read and write arbitrary files on the host system. This unauthorized access can be escalated to execute arbitrary code on the host, potentially compromising the entire system's security and integrity.
Mitigation Recommendations
A fix is available in Flatpak version 1.18.1. Users and administrators should upgrade to Flatpak 1.18.1 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official update.
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to… (CVE-2026-90616)
Description
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Flatpak versions prior to 1.18.1, a sandboxed application can exploit missing symlink protection in certain app data directories (such as /var/cache, /var/data, /var/config, and /var/tmp) created on each app launch. These directories may include attacker-controlled components, allowing malicious symlinks to redirect bind mounts to arbitrary host filesystem locations. Since Flatpak uses bubblewrap (bwrap) to bind these paths, and the kernel follows symlinks, this results in the sandboxed app obtaining arbitrary read and write access to host files. This vulnerability can be escalated to arbitrary code execution on the host. This is a separate issue from CVE-2026-76925.
Potential Impact
A malicious sandboxed application can bypass intended sandbox restrictions to read and write arbitrary files on the host system. This unauthorized access can be escalated to execute arbitrary code on the host, potentially compromising the entire system's security and integrity.
Mitigation Recommendations
A fix is available in Flatpak version 1.18.1. Users and administrators should upgrade to Flatpak 1.18.1 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vhx5-8pfj-7wrv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90616"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aa5eff555bf5e2cf5ef69a0
Added to database: 09/13/2026, 00:36:05 UTC
Last enriched: 09/13/2026, 00:37:04 UTC
Last updated: 09/13/2026, 03:44:35 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.