A vulnerability in Flatpak before version 1.10.2-16.oe2203sp4 allows a local attacker to exploit symlink traversal in the revokefs writer used by the flatpak-system-helper. This can lead to tampering with ostree commit objects after signature verification, enabling local root privilege escalation.