Flatpak · weakness class
File and Path Handling
10 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.
- flatpak-builder can access files outside the build directory.
- Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
- XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
- Flatpak affected by arbitrary file deletion on the host filesystem
- flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files
- Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
- In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host…
- Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
- In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The f…
- In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal ..…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.