Flatpak has rolled out versions 1.18.1 and the 1.19.0 pre-release to address a series of high-severity security vulnerabilities. Because Flatpak is widely used across various Linux distributions and serves as the primary method for installing third-party software in Desktop Mode on Valve's SteamOS, users are advised to check their system updates immediately.
Quick Facts
- Versions: Flatpak 1.18.1 and 1.19.0 pre-release
- Release Date: August 13, 2026
- Platforms: Linux systems utilizing Flatpak
Key Security Fixes Included
The newly released updates patch multiple attack vectors that allowed applications to bypass security barriers. Specifically, the patches resolve issues where:
- Apps could escape the sandbox with full host filesystem read/write access via symlink attacks on app data directories.
- Local root privilege escalation could occur through revokefs symlink path traversal and commit tampering.
- Arbitrary root writes were possible via symlink and path traversal during extra-data extraction and
flatpak build-init. - Arbitrary host file reads could happen via hardlink path traversal in OCI archive extraction.
- Path traversal vulnerabilities existed via unvalidated architecture parameters in DeployAppstream and extension metadata paths.
- A buffer overflow occurred in OCI delta stream path names on 32-bit systems, alongside fixed-filename writes to arbitrary locations via symlink attacks on .ld.so.
- An anti-downgrade bypass allowed unprivileged users to downgrade system apps.
Users should keep a close eye on their respective Linux system updates to ensure these patches are applied.