CVE-2026-90616: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-90616 is a UNIX symlink-following vulnerability in Flatpak that allows a malicious sandboxed application to obtain arbitrary read and write access to files on the host system, escalating to arbitrary code execution. It affects all Flatpak versions up to and including 1.18.0, and was patched in version 1.18.1. The vulnerability was reported by researcher Ee Yang and publicly disclosed on August 11, 2026, via the oss-security mailing list, with the CVE formally published on September 12, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Openwall).

The root cause is improper handling of symbolic links during app data directory creation (CWE-61: UNIX Symbolic Link Following). When Flatpak launches a sandboxed app, it creates several data directories (e.g., /var/cache, /var/data, /var/config, /var/tmp) under paths such as /home/user/.var/app/APP_ID/cache/tmp, where some path components (e.g., tmp) are attacker-controlled. Flatpak passes these paths directly to bwrap --bind SRC DST without resolving or validating symlinks; the kernel then follows any symlinks present, allowing a malicious symlink placed by the sandboxed app to redirect the bind-mount to an arbitrary host filesystem location. This is a distinct vulnerability from CVE-2026-76925, which was fixed in the same release (GitHub Advisory, GitHub Advisory DB).

Successful exploitation allows any local user running a malicious Flatpak application to read and write arbitrary files on the host filesystem with the privileges of the host user running Flatpak, which can be further escalated to arbitrary code execution on the host. The sandbox isolation guarantee of Flatpak is completely bypassed, exposing sensitive host files including credentials, configuration, and user data. The attack is scoped to the host user's privilege level but can affect system integrity and confidentiality broadly (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability requires a local attacker to install and execute a malicious Flatpak application, which raises the bar slightly (Attack Complexity: High), but no privileges are required within the sandbox. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Prepare malicious Flatpak app: Create or modify a Flatpak application package that, upon launch, places a malicious symlink in an attacker-controlled path component of the app data directory (e.g., replace ~/.var/app/APP_ID/cache/tmp with a symlink pointing to a sensitive host directory such as /etc or /home/victim).
2. Install the malicious app: Convince the target user to install the malicious Flatpak application (e.g., via a third-party Flatpak repository or a crafted .flatpak bundle).
3. Trigger app launch: When the user launches the app, Flatpak creates app data directories and calls bwrap --bind /home/user/.var/app/APP_ID/cache/tmp DST without resolving the symlink.
4. Kernel follows symlink: The kernel follows the malicious symlink, causing the targeted host directory (e.g., /etc) to be bind-mounted inside the sandbox at the expected mount point.
5. Access host filesystem: From within the sandbox, the attacker now has read and write access to the bind-mounted host directory, enabling exfiltration of sensitive files or modification of host configuration.
6. Escalate to code execution: Write a malicious script or binary to a host location that will be executed (e.g., overwrite a cron job, .bashrc, or other user-writable executable), achieving arbitrary code execution on the host (GitHub Advisory, Openwall).

• File System: Unexpected symlinks in ~/.var/app/<APP_ID>/ subdirectories (e.g., cache, data, config, tmp) pointing to locations outside the app's data directory; unexpected files modified in host directories such as /etc, /home, or user config directories shortly after a Flatpak app launch.
• Logs: System journal entries (journalctl) showing bwrap bind-mount operations to unusual host paths; Flatpak session logs referencing unexpected mount sources.
• Process: Unusual child processes spawned from within a Flatpak sandbox (e.g., shell processes accessing files outside expected sandbox paths); bwrap invocations with SRC paths resolving to sensitive host directories.

Upgrade Flatpak to version 1.18.1 or later, which hardens ensure_data_dir and /var setup against symlink attacks via commit 4780729 (GitHub Advisory). For LTS distributions unable to upgrade immediately, backports of the fix are available in the flatpak-1.16.x upstream branch; note that cherry-picked libglnx changes (glnx_chaseat_full and glnx_chase_and_mkdirat) are also required (Openwall). As a temporary workaround, restrict the installation and execution of untrusted or unknown Flatpak applications, since exploitation requires a malicious app to be installed and launched by the user.

The vulnerability was disclosed alongside nine other Flatpak security fixes in the 1.18.1 release, announced by Simon McVittie (Collabora Ltd./Debian) on the oss-security mailing list on August 11, 2026 (Openwall). The coordinated multi-vulnerability release drew attention to the breadth of symlink and path traversal issues in Flatpak's sandbox implementation. No notable independent researcher commentary or significant social media discussion has been identified beyond the official disclosure channels.