Bug 2532613 (CVE-2026-90616) - CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
Summary: CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink...
Keywords:
Status: NEW
Alias: CVE-2026-90616
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2532950
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-12 20:21 UTC by OSIDB Bzimport
Modified: 2026-10-29 18:27 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:80497 0 None None None 2026-10-12 03:09:29 UTC
Red Hat Product Errata RHSA-2026:80498 0 None None None 2026-10-12 02:15:24 UTC
Red Hat Product Errata RHSA-2026:80687 0 None None None 2026-10-12 10:04:44 UTC
Red Hat Product Errata RHSA-2026:89733 0 None None None 2026-10-26 02:08:42 UTC
Red Hat Product Errata RHSA-2026:90364 0 None None None 2026-10-26 18:54:49 UTC
Red Hat Product Errata RHSA-2026:92221 0 None None None 2026-10-29 18:27:29 UTC
Red Hat Product Errata RHSA-2026:92369 0 None None None 2026-10-29 12:56:55 UTC

Description OSIDB Bzimport 2026-09-12 20:21:16 UTC 
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.
Comment 2 Jon Orris 2026-10-12 02:15:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:80498 https://access.redhat.com/errata/RHSA-2026:80498
Comment 3 Jon Orris 2026-10-12 03:09:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:80497 https://access.redhat.com/errata/RHSA-2026:80497
Comment 4 Jon Orris 2026-10-12 10:04:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:80687 https://access.redhat.com/errata/RHSA-2026:80687
Comment 5 Jon Orris 2026-10-26 02:08:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:89733 https://access.redhat.com/errata/RHSA-2026:89733
Comment 6 Jon Orris 2026-10-26 18:54:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:90364 https://access.redhat.com/errata/RHSA-2026:90364
Comment 7 Jon Orris 2026-10-29 12:56:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92369 https://access.redhat.com/errata/RHSA-2026:92369
Comment 8 Jon Orris 2026-10-29 18:27:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:92221 https://access.redhat.com/errata/RHSA-2026:92221
Note You need to log in before you can comment on or make changes to this bug.