CVE-2026-90616 Flatpak CVE debrief

Who should care

Defenders responsible for maintaining and securing systems using Flatpak should assess exposure and prioritize updating Flatpak to version 1.18.1 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update Flatpak, assess exposure in their environments, and monitor for suspicious activity in sandboxed apps.

Why it matters

Defenders should prioritize verifying and updating Flatpak to version 1.18.1 or later, and assess exposure in their environments, as a malicious sandboxed app can obtain arbitrary read and write access to files on the host, potentially leading to arbitrary code execution.

• arbitrary code execution on the host
• escalation of privileges from sandboxed apps
• potential data breaches or unauthorized access

Technical summary

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host. Flatpak creates app data directories in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. The issue allows a malicious symlink to point to arbitrary locations on the host and become mounted inside the sandbox, potentially leading to arbitrary code execution.

Defensive priority

Defenders should prioritize verifying and updating Flatpak to version 1.18.1 or later, and assess exposure in their environments.

Recommended defensive actions

• Verify and update Flatpak to version 1.18.1 or later
• Assess exposure in environments using Flatpak
• Monitor for suspicious activity in sandboxed apps
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions or remediation beyond updating Flatpak. The issue is caused by the combination of attacker-controlled path components and missing symlink protection in Flatpak's directory creation process. Defenders should verify and update Flatpak to version 1.18.1 or later, assess exposure in their environments, and monitor for suspicious activity in sandboxed apps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.