Symlink Vulnerability in Flatpak Affects Multiple Applications

CVE-2026-96807

What is CVE-2026-96807?

Before version 1.18.1, a vulnerability in Flatpak allows a malicious sandboxed application to create a symbolic link that replaces a critical file, ~/.var/app/$appid/.ld.so. This can result in the regeneration of the linker cache at an unintended location. While the filenames and content produced are not controlled by the attacker, the potential risk remains significant, allowing for unintended file writes.

References