AIKIDO-2026-566452
flatpak is vulnerable to Path Traversal
65
Medium Risk
This Affects:
flatpakTL;DR
When extracting OCI layer archives, Flatpak rebases archive entry pathnames to the destination directory and rejects .. components, but it does not rebase hardlink targets. A crafted archive entry with an absolute hardlink target causes libarchive to hardlink that host file directly into the extraction directory, exposing its contents. A malicious OCI registry can use this during install or update to read arbitrary host files on system installs that run as root. The fix rebases hardlink targets into the extraction directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you install or update applications from an untrusted OCI registry.
Background info
flatpak is vulnerable to Path Traversal in versions 1.17.0 - 1.18.0.
How to fix this
Upgrade the flatpak library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant