Flatpak before version 1.10.2-16.oe2403sp1 contains a vulnerability where a malicious sandboxed application can replace the file ~/.var/app/$appid/.ld.so with a symbolic link. This causes the regenerate_ld_cache process to write files to arbitrary locations. However, the filenames and content written are not attacker-controlled, limiting exploitability. This issue is fixed in version 1.10.2-16.oe2403sp1.