icon

We found results for “

CVE-2022-21682

Date: January 12, 2022

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies "finish-args" last in the build. At this point the build directory will have the full access that is specified in the manifest, so running "flatpak build" against it will gain those permissions. Normally this will not be done, so this is not problem. However, if "--mirror-screenshots-url" is specified, then flatpak-builder will launch "flatpak build --nofilesystem=host appstream-utils mirror-screenshots" after finalization, which can lead to issues even with the "--nofilesystem=host" protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the "appstream-util" binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of "--nofilesystem=home" and "--nofilesystem=host".

Language: C

Severity Score

Severity Score

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us