CyberRota Analysis
AI-GeneratedFlatpak is vulnerable due to the creation of temporary child repository directories with world-writable permissions, allowing other local users on multi-user systems to read or modify these directories. This could lead to installation failures and denial of service, as tampered content would fail signature verification. Users managing multi-user environments should prioritize addressing this issue to mitigate potential disruptions and ensure the integrity of application installations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.