AIKIDO-2026-190011

TL;DR

Flatpak sets up per-app data directories such as /var/cache, /var/config and /var/tmp inside every sandbox on each app launch, using path components that the running application can control. The directory setup does not protect against symlinks, so a malicious sandboxed app can replace one of these paths with a symlink that is then passed to bwrap --bind. Because the kernel follows the symlink, an attacker-chosen host location is bind-mounted into the sandbox, giving the app arbitrary read and write access to the host filesystem and enabling code execution in the host context. The fix hardens the data directory and /var setup with fd-relative operations that resist symlink substitution.