{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2024-42472 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-42472 is a critical path traversal vulnerability in Debian Debian Linux, published on 15 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-42472 and fix it if it is affected.\n\nWhat it is: CVE-2024-42472 is a critical path traversal vulnerability in Debian Debian Linux, published on 15 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-42472 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-42472/ (Markdown: https://insights.sbomify.com/CVE-2024-42472/index.md)","id":"CVE-2024-42472","markdown":"https://insights.sbomify.com/CVE-2024-42472/index.md","name":"CVE-2024-42472","record":{"aliases":["ALPINE-CVE-2024-42472","ALSA-2024:6356","ALSA-2024:6422","ALSA-2024:9449","CLEANSTART-2024-UL58888","CLSA-2024-1726313380","CLSA-2025-1741125454","CLSA-2025-1741291194","DEBIAN-CVE-2024-42472","DLA-4099-1","DSA-5749-1","GHSA-7hgv-f2j8-xw87","MGASA-2025-0303","OESA-2024-2053","RHSA-2024:6355","RHSA-2024:6356","RHSA-2024:6357","RHSA-2024:6417","RHSA-2024:6418","RHSA-2024:6419","RHSA-2024:6420","RHSA-2024:6421","RHSA-2024:6422","RHSA-2024:9449","RLSA-2024:6356","RLSA-2024:6422","RLSA-2024:9449","SUSE-SU-2024:3073-1","SUSE-SU-2024:3104-1","SUSE-SU-2024:3174-1","UBUNTU-CVE-2024-42472","USN-7046-1","openSUSE-SU-2024:14269-1","openSUSE-SU-2024:14275-1"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Linux sandboxing framework","requires_auth":"none","summary":"A malicious Flatpak app can escape its sandbox and access or modify files outside the permitted directory by exploiting symlink handling in persistent directories.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"flatpak","vendor":"flatpak"}],"cvss":{"score":10,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","ecosystems":["AlmaLinux:8","AlmaLinux:9","Red Hat:enterprise_linux:8::appstream","Red Hat:enterprise_linux:8::baseos","Red Hat:enterprise_linux:8::crb","Red Hat:enterprise_linux:9::appstream","Red Hat:enterprise_linux:9::baseos","Red Hat:enterprise_linux:9::crb","Red Hat:rhel_aus:8.2::appstream","Red Hat:rhel_aus:8.2::baseos","Red Hat:rhel_aus:8.4::appstream","Red Hat:rhel_aus:8.4::baseos","Red Hat:rhel_aus:8.6::appstream","Red Hat:rhel_aus:8.6::baseos","Red Hat:rhel_e4s:8.4::appstream","Red Hat:rhel_e4s:8.4::baseos","Red Hat:rhel_e4s:8.6::appstream","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_e4s:9.0::appstream","Red Hat:rhel_e4s:9.0::baseos","Red Hat:rhel_els:7","Red Hat:rhel_eus:8.8::appstream","Red Hat:rhel_eus:8.8::baseos","Red Hat:rhel_eus:8.8::crb","Red Hat:rhel_eus:9.2::appstream","Red Hat:rhel_eus:9.2::baseos","Red Hat:rhel_eus:9.2::crb","Red Hat:rhel_tus:8.4::appstream","Red Hat:rhel_tus:8.4::baseos","Red Hat:rhel_tus:8.6::appstream","Red Hat:rhel_tus:8.6::baseos","Rocky Linux:8","Rocky Linux:9","SUSE:Enterprise Storage 7.1","SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","SUSE:Linux Enterprise Module for Basesystem 15 SP5","SUSE:Linux Enterprise Module for Basesystem 15 SP6","SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","SUSE:Linux Enterprise Server 12 SP5","SUSE:Linux Enterprise Server 15 SP2-LTSS","SUSE:Linux Enterprise Server 15 SP3-LTSS","SUSE:Linux Enterprise Server 15 SP4-LTSS","SUSE:Linux Enterprise Server for SAP Applications 12 SP5","SUSE:Linux Enterprise Server for SAP Applications 15 SP2","SUSE:Linux Enterprise Server for SAP Applications 15 SP3","SUSE:Linux Enterprise Server for SAP Applications 15 SP4","SUSE:Manager Proxy 4.3","SUSE:Manager Server 4.3","openSUSE:Leap 15.5","openSUSE:Leap 15.6","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Flatpak may allow access to files outside sandbox for certain apps","id":"CVE-2024-42472","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux"],"type":"path_traversal","year":"2024"},"n_packages":261,"n_references":9,"next":{"headline":"OpenFGA Authorization Bypass","id":"CVE-2024-42473"},"packages":[{"ecosystem":"AlmaLinux:8","fixed":["0.4.0-2.el8_10"],"introduced":["0"],"last_affected":[],"package":"bubblewrap","purl":"pkg:rpm/almalinux/bubblewrap","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:8","fixed":["1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/almalinux/flatpak","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:8","fixed":["1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-devel","purl":"pkg:rpm/almalinux/flatpak-devel","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:8","fixed":["1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs","purl":"pkg:rpm/almalinux/flatpak-libs","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:8","fixed":["1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-selinux","purl":"pkg:rpm/almalinux/flatpak-selinux","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:8","fixed":["1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper","purl":"pkg:rpm/almalinux/flatpak-session-helper","source":"ALSA-2024:6422"},{"ecosystem":"AlmaLinux:9","fixed":["0.4.1-7.el9_4.alma.1"],"introduced":["0"],"last_affected":[],"package":"bubblewrap","purl":"pkg:rpm/almalinux/bubblewrap","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["0.4.1-8.el9_5"],"introduced":["0"],"last_affected":[],"package":"bubblewrap","purl":"pkg:rpm/almalinux/bubblewrap","source":"ALSA-2024:9449"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/almalinux/flatpak","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/almalinux/flatpak","source":"ALSA-2024:9449"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak-devel","purl":"pkg:rpm/almalinux/flatpak-devel","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak-devel","purl":"pkg:rpm/almalinux/flatpak-devel","source":"ALSA-2024:9449"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs","purl":"pkg:rpm/almalinux/flatpak-libs","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs","purl":"pkg:rpm/almalinux/flatpak-libs","source":"ALSA-2024:9449"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak-selinux","purl":"pkg:rpm/almalinux/flatpak-selinux","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak-selinux","purl":"pkg:rpm/almalinux/flatpak-selinux","source":"ALSA-2024:9449"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper","purl":"pkg:rpm/almalinux/flatpak-session-helper","source":"ALSA-2024:6356"},{"ecosystem":"AlmaLinux:9","fixed":["1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper","purl":"pkg:rpm/almalinux/flatpak-session-helper","source":"ALSA-2024:9449"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/redhat/flatpak","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-debuginfo","purl":"pkg:rpm/redhat/flatpak-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-debugsource","purl":"pkg:rpm/redhat/flatpak-debugsource","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs","purl":"pkg:rpm/redhat/flatpak-libs","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs-debuginfo","purl":"pkg:rpm/redhat/flatpak-libs-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-selinux","purl":"pkg:rpm/redhat/flatpak-selinux","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper","purl":"pkg:rpm/redhat/flatpak-session-helper","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper-debuginfo","purl":"pkg:rpm/redhat/flatpak-session-helper-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-tests-debuginfo","purl":"pkg:rpm/redhat/flatpak-tests-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:0.4.0-2.el8_10"],"introduced":["0"],"last_affected":[],"package":"bubblewrap","purl":"pkg:rpm/redhat/bubblewrap","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:0.4.0-2.el8_10"],"introduced":["0"],"last_affected":[],"package":"bubblewrap-debuginfo","purl":"pkg:rpm/redhat/bubblewrap-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","fixed":["0:0.4.0-2.el8_10"],"introduced":["0"],"last_affected":[],"package":"bubblewrap-debugsource","purl":"pkg:rpm/redhat/bubblewrap-debugsource","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/redhat/flatpak","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-debuginfo","purl":"pkg:rpm/redhat/flatpak-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-debugsource","purl":"pkg:rpm/redhat/flatpak-debugsource","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-devel","purl":"pkg:rpm/redhat/flatpak-devel","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-libs-debuginfo","purl":"pkg:rpm/redhat/flatpak-libs-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper","purl":"pkg:rpm/redhat/flatpak-session-helper","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-session-helper-debuginfo","purl":"pkg:rpm/redhat/flatpak-session-helper-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:8::crb","fixed":["0:1.12.9-3.el8_10"],"introduced":["0"],"last_affected":[],"package":"flatpak-tests-debuginfo","purl":"pkg:rpm/redhat/flatpak-tests-debuginfo","source":"RHSA-2024:6422"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.12.9-3.el9_4"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/redhat/flatpak","source":"RHSA-2024:6356"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["0:1.12.9-3.el9_5"],"introduced":["0"],"last_affected":[],"package":"flatpak","purl":"pkg:rpm/redhat/flatpak","source":"RHSA-2024:9449"}],"prev":{"headline":"Arbitrary File Write via artifact extraction in actions/artifact","id":"CVE-2024-42471"},"products":["flatpak"],"published":"2024-08-15","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-04-02","vendors":["flatpak"]},"summary":"A malicious Flatpak app can escape its sandbox and access or modify files outside the permitted directory by exploiting symlink handling in persistent directories.","url":"https://insights.sbomify.com/CVE-2024-42472/"}