A critical path traversal vulnerability in Flatpak enables attackers to execute arbitrary file writes on the host system, potentially resulting in full system compromise.

This flaw stems from improper sanitization of blob names and symlink resolution within the extract_extra_data() function. An unauthenticated attacker can exploit this via a malicious or compromised Flatpak repository to perform arbitrary file writes, which occur with root privileges on system-wide installations.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for severe impact. Successful exploitation permits an attacker to overwrite critical system files or inject malicious binaries, leading to total system compromise, unauthorized data access, and potential persistence mechanisms that could undermine the integrity of the entire infrastructure.

Immediate Action: Apply the relevant security updates provided by Red Hat for your specific distribution of Enterprise Linux immediately.

Proactive Monitoring: Review system and application logs for anomalous Flatpak activity or unexpected file modifications in sensitive directories.

Compensating Controls: Restrict the ability of users to install or update software from untrusted or third party Flatpak repositories using system-wide policy configurations.

Public Exploit Available: No (exploit_available: false)

Given the severity of this vulnerability and the potential for root-level code execution, organizations should prioritize patching all affected Red Hat Enterprise Linux systems. Ensure that no untrusted repositories are enabled, as the attack vector relies on the use of a malicious or compromised Flatpak source.