A flaw was found in bubblewrap. During sandbox setup the host filesystem is mounted at /oldroot and the sandboxed root is mounted at /newroot. When bubblewrap creates a file or directory under /newroot, it can follow a parent symlink that points at /oldroot, causing that object to be created on the host instead of inside the sandbox. This occurs during setup, before any sandboxed process is running. Created files use the uid and gid of the user that launched bubblewrap, which is typically unprivileged. The issue affects Flatpak when a malicious or compromised application image is used, and can affect other frameworks that create files on untrusted content with bubblewrap. This vulnerability is tracked by upstream as GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0 by resolving paths with openat2 and RESOLVE_IN_ROOT.