Sebastian Wick
ab6b2e9fb4
flatpak_allocate_tmpdir created child repo directories (repo- and child-oci-) with mode 0777, allowing any local user to modify their contents between the client pull and the system helper deploy. Use 0755 instead, which prevents other users from writing while still allowing the revokefs-fuse frontend to read the backing store directly. The frontend runs as the calling user while the writer backend runs as the flatpak system user, so the frontend needs read access to directories created by the backend. Mode 0700 would break this. Resolves: CVE-2026-97026 Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
See https://flatpak.org/ for more information.
Flatpak is available in the package repositories of most Linux distributions and can be installed from there. See https://flatpak.org/setup/ for quick setup instructions for many distributions.
Community discussion happens in #flatpak:matrix.org, on the mailing list, and on the Flathub Discourse.
Read documentation for Flatpak here.
Contributing
Flatpak welcomes contributions from anyone! Here are some ways you can help:
- Fix one of the issues and submit a PR
- Update flatpak's translations
- Improve flatpak's documentation, hosted at http://docs.flatpak.org and developed over in flatpak-docs
- Find a bug and submit a detailed report including your OS, flatpak version, and the steps to reproduce
- Add your favorite application to Flathub by writing a flatpak-builder manifest and submitting it
- Improve the Flatpak support in your favorite Linux distribution
Hacking
See CONTRIBUTING.md
Related Projects
Here are some notable projects in the Flatpak ecosystem:
- Flatseal: An app for managing permissions of Flatpak apps without using the CLI
- Flat-manager: A tool for managing Flatpak repositories
Host Requirements
Flatpak aims to run on a wide variety of systems. It is therefore conservative with required dependency versions and kernel features.
Currently, the main branch requires at least kernel version 5.8 (for
statx STATX_MNT_ID).