GHSA-8qxj-x646-phcm (https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm)

Impact: If a malicious SDK container declares an extension point with a crafted path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory.

Description: flatpak build-init with --sdk-extensions or --base-extensions copies extension files into the build directory. The target path comes from the directory key in the extension point metadata and is resolved using g_file_resolve_relative_path, which resolves .. components. A malicious extension with directory=../../<path> causes its files to be written outside the build tree. Before copying, the target path is cleaned with flatpak_rm_rf, so existing files at the traversed path are deleted and replaced with the extension's content.

Related to GHSA-fqx6-vh4p-42cg (CVE-2026-96275); solutions share code. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.