A flaw in Flatpak’s ld.so caching mechanism allows a sandboxed application to delete arbitrary files on the host system. The missing boundary checks create a path traversal that falls under CWE-22: Path Traversal. A malicious or compromised app can remove critical host files, compromising confidentiality, integrity, and potentially availability.

The flaw exists in all Flatpak builds before version 1.16.4. Linux systems running Flatpak 1.16.3 or earlier are affected regardless of distribution or host filesystem layout. The affected product is the Flatpak runtime.

The CVSS score of 8.7 indicates a high severity vulnerability, while EPSS data is not available. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local; an attacker must install or run a malicious Flatpak application. Once executed inside the sandbox, the application can trigger deletion of arbitrary host files, presenting a significant risk to system integrity.