https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:33:55.461780+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:7458 ALSA-2022:7458 — Moderate: flatpak-builder security and bug fix update 2026-10-02T20:33:55.491471+00:00

Affected: AlmaLinux:8: flatpak-builder

Flatpak-builder is a tool for building flatpaks from sources.

Security Fix(es):

* flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory (CVE-2022-21682)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/cleanstart-2024-gx04243 CLEANSTART-2024-GX04243 — Flatpak is a Linux application sandboxing and distribution framework 2026-10-02T20:33:55.491547+00:00

Affected: CleanStart: flatpak, CleanStart: flatpak-builder

CVE-2022-21682 affects multiple packages. Flatpak is a Linux application sandboxing and distribution framework. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/cnvd-2022-08917 cnvd-2022-08917 2026-10-02T20:33:55.491574+00:00 cnvd-2022-08917 https://cve.radiocsirt.org/vuln/euvd-2026-13261 EUVD-2026-13261 2026-10-02T20:33:55.491590+00:00 EUVD-2026-13261 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21682 fkie_cve-2022-21682 2026-10-02T20:33:55.491601+00:00

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.

 https://cve.radiocsirt.org/vuln/gsd-2022-21682 gsd-2022-21682 2026-10-02T20:33:55.491641+00:00 gsd-2022-21682 https://cve.radiocsirt.org/vuln/oesa-2022-1788 OESA-2022-1788 — flatpak-builder security update 2026-10-02T20:33:55.491652+00:00

Affected: openEuler:22.03-LTS: flatpak-builder

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.(CVE-2022-21682)

 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0712-1 openSUSE-SU-2022:0712-1 — Security update for flatpak 2026-10-02T20:33:55.491676+00:00

Security update for flatpak

 https://cve.radiocsirt.org/vuln/suse-su-2022:0712-1 SUSE-SU-2022:0712-1 — Security update for flatpak 2026-10-02T20:33:55.491693+00:00

Security update for flatpak

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21682 UBUNTU-CVE-2022-21682 2026-10-02T20:33:55.491708+00:00

Affected: Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:Pro:20.04:LTS: flatpak, Ubuntu:Pro:22.04:LTS: flatpak

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2044 WID-SEC-W-2022-2044 — Red Hat Enterprise Linux: Mehrere Schwachstellen 2026-10-02T20:33:55.491733+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.