{"id":167905,"date":"2026-04-08T11:11:59","date_gmt":"2026-04-08T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya"},"modified":"2026-04-08T11:11:59","modified_gmt":"2026-04-08T09:11:59","slug":"uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","title":{"rendered":"Luka w Flatpak, umo\u017cliwiaj\u0105ca wykonanie kodu poza izolowanym \u015brodowiskiem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W opublikowanej kilka godzin temu wersji koryguj\u0105cej systemu samodzielnych pakiet\u00f3w Flatpak 1.16.4 oraz w wersji eksperymentalnej 1.17.4 usuni\u0119to luk\u0119 (CVE-2026-34078), kt\u00f3ra pozwala z\u0142o\u015bliwej lub skompromitowanej aplikacji w formacie flatpak na obej\u015bcie ustalonego trybu izolacji sandbox, uzyskanie dost\u0119pu do plik\u00f3w w g\u0142\u00f3wnym systemie i wykonanie dowolnego kodu poza trybem izolacji. Problemowi przypisano krytyczny poziom niebezpiecze\u0144stwa (9.3 w skali 10). <\/p>\n

Vulnerability exists in the D-Bus service flatpak-portal, which facilitates the launch of 'portals' used to organize access to resources of the main environment from isolated applications. The issue is caused by the flatpak-portal service allowing applications to specify file paths in the sandbox-expose option, which, due to lack of proper checks, can be symbolic links pointing to arbitrary parts of the filesystem. <\/p>\n

Before mounting, the service reveals the symbolic link and mounts the path it points to in the sandbox environment, allowing isolation to be bypassed and read\/write access to host environment files. To execute code within the system, one could, for example, add an autorun script such as '~\/.bashrc' or '~\/.profile', or modify the file '~\/.ssh\/authorized_keys' with SSH keys. <\/p>\n

The status of the vulnerability remediation in distributions can be assessed on the following pages (if the page is unavailable, it means the distribution developers have not yet begun addressing the issue): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora. As a workaround for protection, the flatpak-portal service can be disabled: sudo systemctl --global mask flatpak-portal.service && systemctl --user stop flatpak-portal.service <\/p>\n

Opr\u00f3cz krytycznej luki w nowej wersji usuni\u0119to jeszcze trzy problemy zwi\u0105zane z bezpiecze\u0144stwem: <\/p>\n