CVE-2026-76925
published 2026-09-04CVE-2026-76925: A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This…
PriorityP432medium5.8CVSS 3.1
AVLACHPRLUINSUCHILAL
EPSS
0.10%
0.9th percentile
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flatpak | flatpak | < 1.18.1 | 1.18.1 |
| flatpak | flatpak | — | — |
CVSS provenance
nvdv3.15.8MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnera
ghsa_unreviewed·2026-09-12·CVSS 5.8
CVE-2026-90616 [MEDIUM] CWE-61 In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnera
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrar
GHSA
A flaw was found in Flatpak.
ghsa_unreviewed·2026-09-05
CVE-2026-76925 [MEDIUM] CWE-367 A flaw was found in Flatpak.
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
VulDB
Flatpak Symlink toctou (Nessus ID 342817)
vuldb·2026-09-05·CVSS 5.8
CVE-2026-76925 [MEDIUM] Flatpak Symlink toctou (Nessus ID 342817)
A vulnerability described as problematic has been identified in Flatpak. This impacts an unknown function of the component Symlink. Executing a manipulation can lead to time-of-check time-of-use.
The identification of this vulnerability is CVE-2026-76925. The attack can only be executed locally. There is no exploit available.
Red Hat
flatpak: Flatpak: Arbitrary code execution via missing symlink protection
vendor_redhat·2026-09-12·CVSS 5.8
CVE-2026-90616 [MEDIUM] CWE-59 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
flatpak: Flatpak: Arbitrary code execution via missing symlink protection
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the ker
Red Hat
flatpak: Flatpak: TOCTOU race condition allows symlink redirection
vendor_redhat·2026-08-19·CVSS 5.8
CVE-2026-76925 [MEDIUM] CWE-367 flatpak: Flatpak: TOCTOU race condition allows symlink redirection
flatpak: Flatpak: TOCTOU race condition allows symlink redirection
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
Package: flatpak (Red Hat Enterprise Linux 10) - Fix deferred
Package: flatpak (Red Hat Enterprise Linux 7) - Fix deferred
Package: flatpak (Red Hat Enterprise Linux 8) - Fix deferred
Package: flatpak (Red Hat Enterprise Linux 9) - Fix deferred
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection [fedora-all]
bugzilla·2026-09-14·CVSS 5.8
CVE-2026-90616 [MEDIUM] CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection [fedora-all]
CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redire
Bugzilla
CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
bugzilla·2026-09-12·CVSS 5.8
CVE-2026-90616 [MEDIUM] CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
CVE-2026-90616 flatpak: Flatpak: Arbitrary code execution via missing symlink protection
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the pat
Bugzilla
CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection [fedora-all]
bugzilla·2026-08-27
CVE-2026-76925 [MEDIUM] CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection [fedora-all]
CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
TOCTOU race in org.freedesktop.Flatpak.SystemHelper — privileged chmod runs before OSTree repo validation in Deploy(), allowing symlink redirection to arbitrary files.
Bugzilla
CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection
bugzilla·2026-08-19·CVSS 5.8
CVE-2026-76925 [MEDIUM] CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection
CVE-2026-76925 flatpak: Flatpak: TOCTOU race condition allows symlink redirection
TOCTOU race in org.freedesktop.Flatpak.SystemHelper — privileged chmod runs before OSTree repo validation in Deploy(), allowing symlink redirection to arbitrary files.
2026-09-04
Published