AIKIDO-2026-548928
flatpak is vulnerable to Privilege Escalation
78
High Risk
This Affects:
flatpakTL;DR
flatpak uses revokefs system helper to receive repository data from unprivileged callers, which rejects literal .. path components but does not prevent symlink traversal. A local user with an active session can open two revokefs sessions, plant a symlink in one that points into the other, and keep a file descriptor open through it to modify files after they are validated and imported by the privileged helper. This lets the user tamper with ostree commit objects after signature verification, producing root-controlled writes to attacker-chosen paths and local root privilege escalation. The fix makes revokefs link, rename, symlink, and chmod operations resist symlink path traversal out of the base directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and allow active local users to update signed content without administrator authentication.
Background info
flatpak is vulnerable to Privilege Escalation in versions 0.0.1 - 1.18.0.
How to fix this
Upgrade the flatpak library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant