CVE-2026-90616: flatpak UNIX Symbolic Link (Symlink) Following

Vulnerability summary

CVE-2026-90616 is a high (CVSS 7.4) UNIX Symbolic Link (Symlink) Following vulnerability in flatpak. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.7% of scored vulnerabilities.

Timeline

1. 12-09-2026
   PublishedVulnerability first disclosed.
2. 14-09-2026
   Last modifiedVulnerability information updated.

Description

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories. Some of these directories are bind-mounted by Flatpak by passing the path (e.g., /home/user/.var/app/APP_ID/cache/tmp), which contains attacker-controlled directories (tmp) to bwrap --bind SRC DST. bwrap passes the path on to the kernel, which then follows symlinks. A malicious symlink can point to arbitrary locations on the host and it will become mounted inside the sandbox.

• CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.