This CVE concerns a path traversal vulnerability in Flatpak extensions. A malicious extension can query the host filesystem to determine whether arbitrary files or directories exist, enabling the extension or sandboxed applications to infer host directory structure. Additionally, unvalidated extension metadata allows the extension’s content to be mounted at unintended locations inside the sandbox. The flaw exposes host information and can lead to unintended data exposure, representing a classic file exists oracle and unauthorized mount.

Affected systems include all Red Hat Enterprise Linux releases that ship Flatpak. Red Hat Enterprise Linux 7, 8, 9, and 10 are explicitly mentioned in the vendor advisory. No specific Flatpak version numbers or other product variants are listed, so any Flatpak installation on these OS editions remains potentially vulnerable until an official fix is applied.

The CVSS score of 3.1 indicates low severity, and the EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivery of a malicious Flatpak extension from a non‑trusted repository, requiring the victim to install it. While no public exploits have been reported, the impact is primarily low‑severity information disclosure. Administrators should treat the risk as low but should apply the workaround immediately.