CVE-2026-96808 in Flatpak
Summary
by MITRE • 09/23/2026
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Flatpak versions prior to 1.18.1 represents a critical path traversal flaw within the revokefs writer component of the flatpak-system-helper service. This helper daemon is responsible for managing repository data received from unprivileged callers, acting as an intermediary between user-space applications and system-level resources. The core technical deficiency lies in the validation logic used to sanitize file paths provided by these callers. While the implementation correctly rejected literal directory traversal sequences such as double dots, it failed to account for symbolic link resolution during path normalization. This oversight created a scenario where relative path components could be resolved through symlinks that pointed outside the intended sandboxed or isolated directories associated with specific revokefs sessions. The flaw effectively bypasses the isolation boundaries established by the system helper, allowing an attacker to manipulate file paths in ways that were not anticipated by the security model of the application.
The operational impact of this vulnerability is severe due to its potential for local privilege escalation. A malicious user account within an active local session can exploit this logic error by first obtaining two distinct revokefs sessions through interactions with the system helper. By creating a symbolic link in one session that points into the directory structure of another session, the attacker establishes a bridge between these isolated environments. The attacker then retains a file descriptor to a target location via this symlinked path. Because the validation occurs before the final resolution or does not adequately re-validate after symlink traversal, the system helper permits operations on files belonging to the other session even after they have been validated and imported. This mechanism allows an unprivileged user to modify critical repository data without proper authorization checks for that specific context.
The most significant consequence of this flaw is the ability to tamper with ostree commit objects within the system repository after they have passed cryptographic signature verification. Ostree relies on these signatures to ensure the integrity and authenticity of software packages. By modifying a commit object post-verification, an attacker can inject malicious content or alter package metadata while maintaining the appearance of legitimacy from a signature perspective. This undermines the trust model of the package manager entirely. Furthermore, this manipulation enables root-controlled file writes to paths chosen by the attacker. Since the system helper operates with elevated privileges to manage repository data, any files written through its interface inherit those permissions. Consequently, an attacker can write arbitrary files to sensitive locations on the filesystem, effectively achieving local root privilege escalation and gaining full control over the affected system.
From a classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, specifically involving symlink following attacks where path normalization is insufficient. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, as the helper assigns permissions based on flawed input validation. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059.004: Command and Scripting Interpreter via Shell or similar mechanisms used for privilege escalation through file system manipulation. The attack vector is local (T1078) and involves abuse of existing functionality rather than external exploitation, making it a high-risk internal threat scenario.
Mitigation strategies must focus on immediate patching and robust input validation practices. Organizations running Flatpak should upgrade to version 1.18.1 or later where this path traversal logic has been corrected to properly resolve symlinks before validating paths against allowed directories. For environments that cannot immediately update, restricting the privileges of the flatpak-system-helper service through mandatory access control systems like SELinux or AppArmor can limit the damage if an exploit is attempted. Additionally, implementing strict file integrity monitoring on ostree repositories and system helper logs can help detect unauthorized modifications to commit objects. Developers should also adopt a principle of least privilege for all daemon services and ensure that path validation occurs after symlink resolution rather than before, preventing traversal attacks from bypassing security controls.