Markus Göllnitz
4256580bcc
D-Bus Services and Desktop Entries could be extended through custom keys. D-Bus daemons and desktop environments augment Applications this way Besides validating Exec= and D-Bus Service Name=, these could lead to denial of service, e.g. X-GNOME-AutoRestart in Desktop Entries, or even code exection outside the sandbox, e.g. SystemdService in D-Bus Services. The only reasonable way to ensure non of these make it through, is exporting only know acceptable ones, instead of hoping to aggregate every problematic one. See: https://specifications.freedesktop.org/desktop-entry/latest/index.html See: https://dbus.freedesktop.org/doc/dbus-specification.html Resolves: CVE-2026-97027 Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh Signed-off-by: Markus Göllnitz <camelcasenick@bewares.it> [smcv: Added CVE ID] Signed-off-by: Simon McVittie <smcv@collabora.com>
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
See https://flatpak.org/ for more information.
Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quick setup instructions for many distributions.
Community discussion happens in #flatpak:matrix.org, on the mailing list, and on the Flathub Discourse.
Read documentation for Flatpak here.
Contributing
Flatpak welcomes contributions from anyone! Here are some ways you can help:
- Fix one of the issues and submit a PR
- Update flatpak's translations
- Improve flatpak's documentation, hosted at http://docs.flatpak.org and developed over in flatpak-docs
- Find a bug and submit a detailed report including your OS, flatpak version, and the steps to reproduce
- Add your favorite application to Flathub by writing a flatpak-builder manifest and submitting it
- Improve the Flatpak support in your favorite Linux distribution
Hacking
See CONTRIBUTING.md
Related Projects
Here are some notable projects in the Flatpak ecosystem:
- Flatseal: An app for managing permissions of Flatpak apps without using the CLI
- Flat-manager: A tool for managing Flatpak repositories
Host Requirements
Flatpak aims to run on a wide variety of systems. It is therefore conservative with required dependency versions and kernel features.
Currently, the main branch requires at least kernel version 5.8 (for
statx STATX_MNT_ID).