Arbitrary Code Execution in Flatpak by Malicious Sandboxed Application

CVE-2026-90616

What is CVE-2026-90616?

Flatpak versions before 1.18.1 are vulnerable to exploitation by malicious sandboxed applications, which can gain unauthorized read and write access to files on the host system. This vulnerability arises from improperly handled symlinks and attacker-controlled directories, allowing a sandboxed app to redirect file paths. As a consequence, an attacker can execute arbitrary code on the host by exploiting the sandbox environment. It is crucial for users of Flatpak to upgrade to the latest version to mitigate the risks associated with this severe security issue.

References