Critical Security Flaw in Flatpak: Arbitrary Code Execution and File Deletion Vulnerabilities
Summary
ALSA-2026:21755: Important: flatpak security update. Affects flatpak versions < 1.12.9-4.el9_8.1. Fixed in 1.12.9-4.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a powerful system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package applications with their dependencies, ensuring consistent behavior across different Linux distributions. However, recent vulnerabilities have been discovered that could compromise the security of systems using Flatpak, particularly affecting versions prior to 1.12.9-4.el9_8.1.
Vulnerability Detail
The vulnerabilities identified in Flatpak include arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) and arbitrary file deletion on the host due to improper cache file path validation (CVE-2026-34079). These vulnerabilities arise from flaws in how Flatpak handles symlinks and cache file paths, potentially allowing attackers to execute malicious code or delete critical files on the host system.
How To Fix
Minimum fixed version
1.12.9-4.el9_8.1
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of sandbox-expose options in Flatpak until the update is applied. Additionally, ensure that sensitive files are not exposed to Flatpak applications until the vulnerabilities are resolved.
Conclusion
The recent vulnerabilities in Flatpak pose significant security risks, including arbitrary code execution and file deletion. Users are strongly advised to update their Flatpak installations to the latest patched version to mitigate these risks. Additionally, temporary workarounds can help protect systems until updates are applied.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, allowing for consistent application behavior across different distributions.
The vulnerabilities include arbitrary code execution through crafted symlinks and arbitrary file deletion due to improper cache file path validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
As a workaround, limit the use of sandbox-expose options and avoid exposing sensitive files to Flatpak applications until the vulnerabilities are patched.
For more details, refer to the CVE pages listed in the advisory or consult the official Flatpak documentation.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
