Read the docs
TI-2022-06058 Aliases CVE-2022-21682

flatpak-builder can access files outside the build directory.

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.

Why it matters now

EPSS 0.01841 79th percentileScored 2026-11-07
Fix Fixed flatpak (flatpak): 1.12.3, 1.10.6Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
flatpakflatpak1.11.0 to before 1.12.3; before 1.10.61.12.3, 1.10.6Patch availableCNA
  • flatpak Vendorflatpak Affected 1.11.0 to before 1.12.3; before 1.10.6 Fixed in 1.12.3, 1.10.6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*before 1.10.7; 1.11.1 to before 1.12.4Vulnerableflatpak
cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:*before 1.2.2Vulnerableflatpak
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:* Versions before 1.10.7; 1.11.1 to before 1.12.4 Vulnerable ·flatpak
  • cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:* Versions before 1.2.2 Vulnerable ·flatpak
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA flatpak (flatpak) Fixed in 1.12.3, 1.10.6

Red Hat 1 advisory

  • RHSA-2022:7458 Released 2022-11-08 · Red Hat rating Moderate
    flatpak-builder security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) flatpak-builder-1.0.14-2.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    flatpak — FEDORA-2022-825ca6bf2b

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-19666 Permissions granted to applications can be hidden from the user at install timePriority MEDIUM 40
    Show all 2 records → Advisory →
  • Advisory ·

    flatpak — DSA-5049

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-19666 Permissions granted to applications can be hidden from the user at install timePriority MEDIUM 40
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7458
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21682

References

Patch 3

Advisory 4

  • TI-2026-26401 Flatpak has a complete sandbox escape leading to host file access and code execution in the host context CVSS 4.0CRITICAL 9.3
  • TI-2024-28440 Flatpak may allow access to files outside sandbox for certain apps CVSS 3.1CRITICAL 10.0
  • TI-2023-12679 TIOCLINUX can send commands outside sandbox if running on a virtual console CVSS 3.1CRITICAL 10.0
  • TI-2026-26402 Flatpak affected by arbitrary file deletion on the host filesystem CVSS 4.0HIGH 8.7
  • TI-2019-07389 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a… CVSS 3.0CRITICAL 9.0
  • TI-2021-19666 Permissions granted to applications can be hidden from the user at install time CVSS 3.1HIGH 8.6
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences