CVE-2022-21682
flatpak-builder can access files outside the build directory.
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
flatpak-builder can access files outside the build directory.
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
CVE-2022-21682- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-26892
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
EUVD-2022-26892- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-03
NVD
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
CVE-2022-21682- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-21682
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
ALPINE-CVE-2022-21682- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
flatpak-builder can access files outside the build directory.
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
CVE-2022-21682- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-21682
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
DEBIAN-CVE-2022-21682- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
Show 10 moreShow less
OSVOESA-2022-1788
flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.(CVE-2022-21682)
- Record
OESA-2022-1788- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2022:7458
Red Hat Security Advisory: flatpak-builder security and bug fix update
- Record
RHSA-2022:7458- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRLSA-2022:7458
Moderate: flatpak-builder security and bug fix update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory (CVE-2022-21682)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.
- Record
RLSA-2022:7458- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-21682
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
- Record
UBUNTU-CVE-2022-21682- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVALSA-2022:7458 No score
Moderate: flatpak-builder security and bug fix update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
- flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory (CVE-2022-21682)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:7458- Updated
- 2026-11-02
OSVMGASA-2022-0131 No score
Updated flatpak packages fix security vulnerability
Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. (CVE-2021-43860) Path traversal vulnerability (CVE-2022-21682) Various other fixes and enhancements included in update to version 1.12.7.
- Record
MGASA-2022-0131- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0712-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
Update to flatpak 1.10.7:
- CVE-2022-21682: Introduce new option --nofilesystem=host:reset to support flatpak-builder 1.2.2 (bsc#1194611).
- CVE-2021-43860: A malicious repository could hav sent invalid application metadata in a way that hides some of the app permissions displayed during installation (bsc#1194610).
- Record
openSUSE-SU-2022:0712-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11755-1 No score
flatpak-builder-1.2.2-1.1 on GA media
These are all security issues fixed in the flatpak-builder-1.2.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11755-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11756-1 No score
flatpak-1.12.4-1.1 on GA media
These are all security issues fixed in the flatpak-1.12.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11756-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0712-1 No score
Security update for flatpak
This update for flatpak fixes the following issues:
Update to flatpak 1.10.7:
- CVE-2022-21682: Introduce new option --nofilesystem=host:reset to support flatpak-builder 1.2.2 (bsc#1194611).
- CVE-2021-43860: A malicious repository could hav sent invalid application metadata in a way that hides some of the app permissions displayed during installation (bsc#1194610).
- Record
SUSE-SU-2022:0712-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flatpakAlpine:v3.15 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.16 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.17 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.18 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.19 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.20 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.21 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.22 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.23 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
flatpakAlpine:v3.24 |
1.11.1 up to 1.12.5-r0 | 1.12.5-r0 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
flatpak-builderAlpine:v3.16 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.17 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.18 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.19 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.20 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.21 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.22 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.23 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlpine:v3.24 |
before 1.2.2-r0 | 1.2.2-r0 |
flatpak-builderAlmaLinux:8 |
before 1.0.14-2.el8 | 1.0.14-2.el8 |
flatpakDebian:12 |
before 1.12.3-1 | 1.12.3-1 |
flatpakDebian:13 |
before 1.12.3-1 | 1.12.3-1 |
flatpakDebian:14 |
before 1.12.3-1 | 1.12.3-1 |
flatpakDebian:11 From an advisory covering 2 CVEs |
before 1.10.7-0+deb11u1, plus listed versions 1.10.2-31.10.3-0+deb11u11.10.3-0+deb11u1~bpo11+11.10.5-0+deb11u11.10.5-0+deb11u1~bpo10+11.10.7-0+deb11u1~bpo10+1 |
1.10.7-0+deb11u1 |
flatpakMageia:8 From an advisory covering 2 CVEs |
before 1.12.7-1.mga8 | 1.12.7-1.mga8 |
discoverMageia:8 From an advisory covering 2 CVEs |
before 5.20.4-3.3.mga8 | 5.20.4-3.3.mga8 |
gnome-softwareMageia:8 From an advisory covering 2 CVEs |
before 3.38.0-2.1.mga8 | 3.38.0-2.1.mga8 |
xdg-desktop-portal-kdeMageia:8 From an advisory covering 2 CVEs |
before 5.20.4-2.1.mga8 | 5.20.4-2.1.mga8 |
flatpak-builderopenEuler:22.03-LTS |
before 1.0.14-2.oe2203 | 1.0.14-2.oe2203 |
flatpak-builderRed Hat:enterprise_linux:8::appstream |
before 0:1.0.14-2.el8 | 0:1.0.14-2.el8 |
flatpak-builder-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:1.0.14-2.el8 | 0:1.0.14-2.el8 |
flatpak-builder-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:1.0.14-2.el8 | 0:1.0.14-2.el8 |
flatpak-builderRocky Linux:8 |
before 0:1.0.14-2.el8 | 0:1.0.14-2.el8 |
flatpakSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Manager Proxy 4.1 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Manager Retail Branch Server 4.1 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Manager Server 4.1 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpakUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1 Show 16 moreShow less0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1 |
None known |
flatpakUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1 Show 6 moreShow less1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1 |
None known |
flatpakUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1 Show 5 moreShow less1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1 |
None known |
flatpakopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.7-4.12.1 | 1.10.7-4.12.1 |
flatpak-builderopenSUSE:Tumbleweed |
before 1.2.2-1.1 | 1.2.2-1.1 |
flatpakopenSUSE:Tumbleweed |
before 1.12.4-1.1 | 1.12.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-21682 is a high vulnerability (CVSS 7.7) in Debian Linux, published January 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in flatpak 1.12.5-r0.
References
github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fx
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH
debian.org/security/2022/dsa-5049
Show 37 moreShow less
security.gentoo.org/glsa/202312-12
security.alpinelinux.org/vuln/CVE-2022-21682
access.redhat.com/errata/RHSA-2022:7458
bugzilla.redhat.com/2041592
errata.almalinux.org/8/ALSA-2022-7458.html
nvd.nist.gov/vuln/detail/CVE-2022-21682
security-tracker.debian.org/tracker/CVE-2022-21682
advisories.mageia.org/MGASA-2022-0131.html
bugs.mageia.org/show_bug.cgi?id=29885
lists.opensuse.org/archives/list/[email protected]/thread/T4OG73MX3JPZBHYMUXUULPTVL7ZOOTZ5
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1788
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7458.json
cve.org/CVERecord?id=CVE-2022-21682
errata.rockylinux.org/RLSA-2022:7458
suse.com/support/update/announcement/2022/suse-su-20220712-1
bugzilla.suse.com/1194610
ubuntu.com/security/CVE-2022-21682