{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-90616: fix symlink-following sandbox escape in app data dir creation\n and /var bind mounts", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/advisories/2026/clsa-2026_1792032323.json" } ], "tracking": { "current_release_date": "2026-10-20T09:31:06Z", "generator": { "date": "2026-10-20T09:31:06Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792032323", "initial_release_date": "2026-10-15T02:45:24Z", "revision_history": [ { "date": "2026-10-15T02:45:24Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-20T09:31:06Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "flatpak: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "product": { "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "product_id": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-builder@1.0.0-13.el7.tuxcare.els5?arch=i686" } } }, { "category": "product_version", "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "product": { "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "product_id": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-libs@1.0.9-13.el7.tuxcare.els5?arch=i686" } } }, { "category": "product_version", "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "product": { "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "product_id": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-devel@1.0.9-13.el7.tuxcare.els5?arch=i686" } } }, { "category": "product_version", "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "product": { "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "product_id": "flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak@1.0.9-13.el7.tuxcare.els5?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "product": { "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "product_id": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-builder@1.0.0-13.el7.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product": { "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_id": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-libs@1.0.9-13.el7.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product": { "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_id": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak-devel@1.0.9-13.el7.tuxcare.els5?arch=x86_64" } } }, { "category": "product_version", "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product": { "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_id": "flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/flatpak@1.0.9-13.el7.tuxcare.els5?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686" }, "product_reference": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64" }, "product_reference": "flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" }, "product_reference": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686" }, "product_reference": "flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686" }, "product_reference": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64" }, "product_reference": "flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.i686 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686" }, "product_reference": "flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64" }, "product_reference": "flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-42472", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" }, "notes": [ { "category": "description", "text": "Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-42472" }, { "category": "external", "summary": "https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c", "url": "https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c" }, { "category": "external", "summary": "https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5", "url": "https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72", "url": "https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a", "url": "https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75", "url": "https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97", "url": "https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788", "url": "https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19", "url": "https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/08/14/6", "url": "http://www.openwall.com/lists/oss-security/2024/08/14/6" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00025.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00025.html" } ], "release_date": "2024-08-15T19:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-15T02:45:24.855891Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323", "product_ids": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-34079", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-34079" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp" } ], "release_date": "2026-04-07T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-15T02:45:24.855891Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323", "product_ids": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2021-43860", "cwe": { "id": "CWE-269", "name": "Improper Privilege Management" }, "notes": [ { "category": "description", "text": "Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the \"xa.metadata\" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the \"metadata\" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-43860" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da", "url": "https://github.com/flatpak/flatpak/commit/54ec1a482dfc668127eaae57f135e6a8e0bc52da" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042", "url": "https://github.com/flatpak/flatpak/commit/65cbfac982cb1c83993a9e19aa424daee8e9f042" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451", "url": "https://github.com/flatpak/flatpak/commit/93357d357119093804df05acc32ff335839c6451" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e", "url": "https://github.com/flatpak/flatpak/commit/ba818f504c926baaf6e362be8159cfacf994310e" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee", "url": "https://github.com/flatpak/flatpak/commit/d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/releases/tag/1.10.6", "url": "https://github.com/flatpak/flatpak/releases/tag/1.10.6" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/releases/tag/1.12.3", "url": "https://github.com/flatpak/flatpak/releases/tag/1.12.3" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202312-12", "url": "https://security.gentoo.org/glsa/202312-12" }, { "category": "external", "summary": "https://www.debian.org/security/2022/dsa-5049", "url": "https://www.debian.org/security/2022/dsa-5049" } ], "release_date": "2022-01-12T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-15T02:45:24.855891Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323", "product_ids": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90616", "cwe": { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following" }, "notes": [ { "category": "description", "text": "In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90616" }, { "category": "external", "summary": "https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj", "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2026/08/11/9", "url": "https://www.openwall.com/lists/oss-security/2026/08/11/9" } ], "release_date": "2026-09-12T20:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-15T02:45:24.855891Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323", "product_ids": [ "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-builder-0:1.0.0-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-devel-0:1.0.9-13.el7.tuxcare.els5.x86_64", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.i686", "CloudLinux-7:flatpak-libs-0:1.0.9-13.el7.tuxcare.els5.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792032323" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }