10

CVE-2023-28100: flatpak Improper Input Validation

CVSS: 10.0v3.1CriticalModified
AliasesUBUNTU-CVE-2023-28100DEBIAN-CVE-2023-28100
Published 16-03-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2023-28100 is a critical (CVSS 10.0) Improper Input Validation vulnerability in flatpak. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.3% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.87%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 5
MGASA-2023-0115OPENSUSE-SU-2024:12800-1RHSA-2023:6518RHSA-2023:7038SUSE-SU-2023:1712-1SUSE-SU-2023:1713-1

Timeline

  1. 16-03-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

0.00 pp

From 0.87% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • flatpak< 1.14.4-1
Flatpak1 product
  • flatpak< 1.10.8 | ≥ 1.12.0, < 1.12.8 | ≥ 1.14.0, < 1.14.4 | ≥ 1.15.0, < 1.15.4
Ubuntu1 product
  • flatpakAll versions (No fix recorded)

3 vendors · 3 products

References

7 links