Summary
A path traversal and symlink-following weakness in Flatpak's extra-data extraction can allow content from a malicious or compromised repository to be written to arbitrary locations on the host filesystem. On system installations, the operation may run with root privileges, increasing the potential for system compromise.
Affected context
The vulnerability occurs when Flatpak processes extra data from a repository using extract_extra_data(). Risk is present when blob names from xa.extra-data-sources are not constrained to safe relative paths and extraction writes through symlinks under files/extra; system-wide installations may perform these operations with elevated privileges.
Exploit preconditions
- Attack surface: Flatpak repository extra-data processing
- Required access: The victim must use or process a malicious or compromised repository; direct host filesystem access is not necessarily required
- Trigger point: Extraction of repository-provided extra data
- Why exploitation is possible: Unsanitized blob names may contain parent-directory traversal, while filesystem operations can follow symlinks and redirect writes outside the intended extraction directory
- Privilege condition: System installations may execute the extraction with root privileges
Why this happens
The underlying bug combines insufficient path canonicalization with unsafe filesystem handling. Blob names supplied through xa.extra-data-sources can include traversal components such as .., and the destination path beneath files/extra may follow attacker-controlled symlinks. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because externally controlled path information is not reliably confined to the intended extraction root.
Potential impact
- Arbitrary files on the host may be overwritten or created
- System configuration or executable content could be altered
- A system installation could enable code execution with root privileges
- Local security controls or application data could be damaged
- The host may be exposed to persistence, privilege escalation, or broader compromise
General mitigation guidance
Mitigation generally focuses on enforcing a strong extraction boundary and treating repository content as untrusted.
Common defensive patterns include:
- Canonicalizing and validating every destination path before writing
- Rejecting absolute paths and traversal components
- Ensuring resolved destinations remain beneath the intended extraction directory
- Preventing symlink traversal during file creation and replacement
- Using filesystem APIs that provide no-follow or equivalent containment guarantees
- Applying least privilege to installation and extraction processes
- Prefering isolated temporary directories and atomic, policy-controlled moves
- Reducing trust in repository metadata and requiring trusted repository sources where appropriate
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules for path joins involving repository-controlled names
- Code review checks for missing canonicalization, traversal rejection, or symlink handling
- Tests using absolute paths, parent-directory components, nested symlinks, and link replacement races
- Policy enforcement that restricts repository origins and validates package metadata
- Runtime monitoring for privileged writes outside expected Flatpak installation directories
- Automated security review tools that flag archive extraction and filesystem boundary violations
