Flatpak 1.19 and 1.18.1 Released with Multiple Security Fixes
New Flatpak releases patch sandbox escape, privilege escalation, and path traversal vulnerabilities.
Conversation activity · last 12 hours peak 2/15m
Summary, timeline and people extracted by Claude from 6 items across 3 sources · 2h ago. Quotes are verbatim.
Flatpak, the Linux application sandboxing framework, released version 1.19 (development) and 1.18.1 (stable) on August 11, 2026, addressing nine security vulnerabilities. The fixes include critical issues such as sandbox escape enabling full read/write access to host filesystems, local root privilege escalation via symlink attacks, and path traversal flaws in OCI handling and extra-data extraction.
- Critical sandbox escape vulnerability allowed apps to read and write anywhere on the host filesystem.
- Local root privilege escalation via symlink path traversal in revokefs and OCI archive extraction affected both development and stable releases.
- Nine security fixes span sandbox isolation, filesystem access, privilege boundaries, OCI handling, and downgrade protection.
- Users are urged to update to Flatpak 1.18.1 or later, especially those running desktop tools and AI applications.
How it unfolded
-
Mastodon users sayzard and governa share the Flatpak release news; sayzard emphasizes the urgency for Linux environments running desktop tools and AI applications to update to 1.18.1 or later.
“Flatpak을 통해 데스크톱 도구나 AI 개발 애플리케이션을 배포·실행하는 Linux 환경은 영향을 확인하고 1.18.1 이상으로 신속히 업데이트해야 한다.”
sayzard · Mastodon ↗ -
Linuxiac publishes detailed breakdown of vulnerabilities fixed: sandbox escape allowing full filesystem access, local root privilege escalation via revokefs symlink path traversal, arbitrary file writes, OCI hardlink path traversal, buffer overflow in 32-bit systems, and downgrade protection bypass.
“The most critical fix in this release stops a sandbox escape that could let an app read and write anywhere on the host filesystem.”
Linuxiac · Mastodon ↗ -
Michael Larabel reports that both Flatpak 1.19 (development) and 1.18.1 (stable) were released with multiple newly-discovered security issues.
-
9to5linux reports the release of Flatpak 1.18.1 with bug and security fixes for the Linux app sandboxing framework.
What people are saying verbatim
“The most critical fix in this release stops a sandbox escape that could let an app read and write anywhere on the host filesystem.”
Linuxiac, Linux news outlet · Linuxiac ↗
“Another key fix stops a local root privilege escalation caused by symlink path traversal in revokefs and commit tampering.”
Linuxiac, Linux news outlet · Linuxiac ↗
“Flatpak을 통해 데스크톱 도구나 AI 개발 애플리케이션을 배포·실행하는 Linux 환경은 영향을 확인하고 1.18.1 이상으로 신속히 업데이트해야 한다.”
sayzard, Mastodon user · Mastodon ↗ · Aug 11, 6:43 PM
“Flatpak 1.18.1 also improves downgrade protection by closing a loophole that let unprivileged users bypass safeguards and downgrade installed apps.”
Linuxiac, Linux news outlet · Linuxiac ↗
“They also fixed a buffer overflow in OCI delta stream path names on 32-bit systems.”
Linuxiac, Linux news outlet · Linuxiac ↗
Voices from the web unedited
-
# Flatpak 1.18.1 # Linux App Sandboxing and Distribution Framework Released with Bug and Security Fixes https:// 9to5linux.com/flatpak-1-18-1-l inux-app-sandboxing-framework-brings-bug-and-security-fixes @ FlatpakApps # OpenSource # FreeSoftware
-
Flatpak 1.18.1 is out with security fixes addressing a sandbox escape, local root privilege escalation, path traversal issues, and arbitrary file writes. https:// linuxiac.com/flatpak-1-18-1-fi xes-sandbox-escape-and-root-privilege-escalation-flaws/ # linux # opensource # flatpak