flatpak

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

flatpak records in CISA KEV

No flatpak vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Flatpak 15 records MEDIUM Flatpak-builder 2 records MEDIUM Xdg-dbus-proxy 1 record LOW Xdg-desktop-portal 1 record LOW

Records

15 records in Flatpak · all components

TI-2026-26401 CVE-2026-34078

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

MEDIUM 51

Flatpak is a Linux application sandboxing and distribution framework.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01709 Published 2026-04-07 Fixed in 1.16.4 CWE-61

TI-2024-28440 CVE-2024-42472

Flatpak may allow access to files outside sandbox for certain apps

MEDIUM 51

Flatpak is a Linux application sandboxing and distribution framework.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01272 Published 2024-08-15 Partial fix · 1.14.10, 1.15.10 CWE-74

TI-2023-12679 CVE-2023-28100

TIOCLINUX can send commands outside sandbox if running on a virtual console

MEDIUM 50

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00878 Published 2023-03-16 Partial fix · 1.10.8, 1.12.8 +2 CWE-20

TI-2026-26402 CVE-2026-34079

Flatpak affected by arbitrary file deletion on the host filesystem

MEDIUM 44

Flatpak is a Linux application sandboxing and distribution framework.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00328 Published 2026-04-07 Fixed in 1.16.4 CWE-22

TI-2019-07389 CVE-2019-10063 · GHSA-mc9j-733x-89cx

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a…

MEDIUM 43

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass.

CVSS 3.0CRITICAL 9.0 Network No auth No interaction EPSS 0.01909 Published 2019-03-26 Fixed CWE-20

TI-2021-19666 CVE-2021-43860

Permissions granted to applications can be hidden from the user at install time

MEDIUM 40

Flatpak is a Linux application sandboxing and distribution framework.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.01441 Published 2022-01-12 Fixed in 1.12.3, 1.10.6 CWE-269

TI-2021-17972 CVE-2021-41133

Sandbox bypass via recent VFS-manipulating syscalls

MEDIUM 40

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00436 Published 2021-10-08 Fixed in 1.10.4, 1.12.0 CWE-20

TI-2024-21357 CVE-2024-32462

Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing

LOW 39

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1HIGH 8.4 Local Low privileges No interaction EPSS 0.00512 Published 2024-04-18 Partial fix · 1.10.9, 1.12.9 +2 CWE-88

TI-2021-04480 CVE-2021-21381

Sandbox escape via special tokens in .desktop file

LOW 39

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1HIGH 8.2 Local No auth User interaction EPSS 0.01546 Published 2021-03-11 Fixed in 1.10.2 CWE-74

TI-2021-04363 CVE-2021-21261

Flatpak sandbox escape via spawn portal

LOW 39

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00595 Published 2021-01-14 Fixed in 1.8.5, 1.10.0 CWE-74

TI-2018-04836 CVE-2018-6560 · GHSA-5xcx-r88v-8v7g

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before…

LOW 38

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not ident…

CVSS 3.0HIGH 8.8 Local Low privileges No interaction EPSS 0.00412 Published 2018-02-02 Fixed CWE-436

TI-2022-06058 CVE-2022-21682

flatpak-builder can access files outside the build directory.

LOW 37

Flatpak is a Linux application sandboxing and distribution framework.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01841 Published 2022-01-13 Fixed in 1.12.3, 1.10.6 CWE-22

TI-2019-05964 CVE-2019-8308 · GHSA-26wh-22xw-qfqx

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra…

LOW 36

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

CVSS 3.0HIGH 8.2 Local Low privileges User interaction EPSS 0.00466 Published 2019-02-12 Fixed CWE-668

TI-2017-07161 CVE-2017-9780 · GHSA-jchq-9f4q-gvc5

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that…

LOW 34

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00355 Published 2017-06-21 No fix listed CWE-732

TI-2023-12680 CVE-2023-28101

Flatpak metadata with ANSI control codes can cause misleading terminal output

LOW 25

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00879 Published 2023-03-16 Partial fix · 1.10.8, 1.12.8 +2 CWE-116

Open these records in search →

Critical	4
High	16
Medium	4
Low	0
No CVSS	0