- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 18
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 5 excluded.
Web 1
- https://flatpak.org
Products and areas 12
- Application metadata parsing: the manifest, the .flatpak bundle format and the declared permission set
- flatpak-builder and the build-time paths that fetch, unpack and patch sources
- Installation, update and uninstall flows for both the system-wide and per-user installations
- OSTree repository handling: remote configuration, GPG signature verification, pull and deploy
- Report privately to the flatpak-security list at freedesktop.org, a closed maintainer list, against a version in the supported matrix around the 1.18.x stable series. No component of the project below that is carved out
- Runtime and extension resolution, including where a runtime's files land inside the sandbox
- The D-Bus proxy (xdg-dbus-proxy) and its filtering of bus traffic in both directions
- The permission store and the way a granted permission is recorded, checked and revoked
- The portal layer in full: the document portal, file chooser, screenshot, camera, location, background and every other portal a confined app can call
- The sandbox construction path, including the bubblewrap argument vector Flatpak builds and the environment it hands over
- The seccomp filters and namespace configuration Flatpak requests for an application
- The system helper, which runs with elevated privilege on behalf of an unprivileged user
Out of scope (5)
- Application-level bugs in software distributed through Flathub rather than in Flatpak itself
- bubblewrap's own privilege handling, which belongs to the Containers project's security list
- Flathub infrastructure rather than the Flatpak codebase
- Kernel namespace and seccomp defects
- Permissions a user was asked for and granted, or an application installed with broad static permissions it declared honestly
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately to the address on the policy page , the closed maintainer list the project publishes
-
Test against a supported version. The project maintains a supported-version matrix around the 1.18.x stable series and fixes land there
-
If the root cause sits in bubblewrap's own privilege handling, report it to the Containers security list instead.
-
Say whether the escape needs permissions the user granted.
-
Name the portal and the backend implementation.
-
State whether the install was system-wide or per-user, since the system helper is only in the path for one of them
Not accepted
-
Application-level bugs in software distributed through Flathub rather than in Flatpak itself
-
Permissions a user was asked for and granted, or an application installed with broad static permissions it declared honestly
-
Kernel namespace and seccomp defects
-
Flathub infrastructure rather than the Flatpak codebase
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-40354 | Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. | Low 2.9 | 11 Apr 2026 |
| CVE-2026-39977 | flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does | High 7.1 | 9 Apr 2026 |
| CVE-2026-34079 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4. | High 8.7 | 7 Apr 2026 |
| CVE-2026-34078 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulne | Critical 9.3 | 7 Apr 2026 |
| CVE-2026-34080 | xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7. | Medium 6.8 | 7 Apr 2026 |
| CVE-2024-42472 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist= | Critical 10.0 | 15 Aug 2024 |
| CVE-2024-32462 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments | High 8.4 | 18 Apr 2024 |
| CVE-2023-28100 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into th | Critical 10.0 | 16 Mar 2023 |
| CVE-2023-28101 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characte | Medium 5.0 | 16 Mar 2023 |
| CVE-2022-21682 | Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not b | High 7.7 | 13 Jan 2022 |
| CVE-2021-43860 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the | High 8.2 | 12 Jan 2022 |
| CVE-2021-41133 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do th | High 8.8 | 8 Oct 2021 |
| CVE-2021-21381 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of | High 7.1 | 11 Mar 2021 |
| CVE-2021-21261 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatp | High 7.3 | 14 Jan 2021 |
| CVE-2019-10063 | Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This f | Critical 9.0 | 26 Mar 2019 |
| CVE-2019-8308 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. | High 8.2 | 12 Feb 2019 |
| CVE-2018-6560 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon. | High 8.8 | 2 Feb 2018 |
| CVE-2017-9780 | In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app a | High 7.8 | 21 Jun 2017 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 16 Lifetime Sandbox escape 40 % Permission bypass 30 % Privilege escalation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Flatpak is the default third-party application channel on Fedora, SteamOS and a long list of other desktop Linux systems, and it is how most users install proprietary or unpackaged software. It builds its sandboxes on bubblewrap. The surface worth attacking is Flatpak's own: the portal layer and the permission model that decide what a confined application may reach on the host. Sixteen advisories over the project's life, four of them in the last twelve months. Reports go to a private maintainer list at freedesktop.org, which offers no bounty and appears on no commercial platform, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Report privately to the flatpak-security list at freedesktop.org, a closed maintainer list, against a version in the supported matrix around the 1.18.x stable series. No component of the project below that is carved out The portal layer in full: the document portal, file chooser, screenshot, camera, location, background and every other portal a confined app can call The permission store and the way a granted permission is recorded, checked and revoked The D-Bus proxy (xdg-dbus-proxy) and its filtering of bus traffic in both directions The sandbox construction path, including the bubblewrap argument vector Flatpak builds and the environment it hands over Application metadata parsing: the manifest, the .flatpak bundle format and the declared permission set OSTree repository handling: remote configuration, GPG signature verification, pull and deploy flatpak-builder and the build-time paths that fetch, unpack and patch sources The system helper, which runs with elevated privilege on behalf of an unprivileged user Runtime and extension resolution, including where a runtime's files land inside the sandbox The seccomp filters and namespace configuration Flatpak requests for an application Installation, update and uninstall flows for both the system-wide and per-user installations Out of scope bubblewrap's own privilege handling, which belongs to the Containers project's security list Application-level bugs in software distributed through Flathub rather than in Flatpak itself Permissions a user was asked for and granted, or an application installed with broad static permissions it declared honestly Kernel namespace and seccomp defects Flathub infrastructure rather than the Flatpak codebase Most-valued findings Sandbox escape through a portal, where a confined application reaches a host resource the portal exists to mediate Anything that grants permissions an application never declared or a user never approved, including direct manipulation of the permission store D-Bus proxy filtering bypass, where a message that should have been dropped reaches the session or system bus Defects in the system helper, since it performs privileged operations at the request of an unprivileged caller Repository and signature handling, where the installed application is not the one the remote's signature actually covers Manifest or bundle parsing that changes the sandbox an application ends up running in Escapes needing only default permissions, which are worth substantially more than escapes from an app the user already trusted with the filesystem Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , the closed maintainer list the project publishes Test against a supported version. The project maintains a supported-version matrix around the 1.18.x stable series and fixes land there Fixes are announced on the project announcement list alongside the release, so watch that rather than waiting for a separate advisory feed If the root cause sits in bubblewrap's own privilege handling, report it to the Containers security list instead. Flatpak owns the sandbox policy; bubblewrap owns its own privilege drop Say whether the escape needs permissions the user granted. An escape from default permissions and an escape from an app already trusted with filesystem access are very different findings Name the portal and the backend implementation. The portal frontend and the desktop-specific backends behave differently and the bug may live in either State whether the install was system-wide or per-user, since the system helper is only in the path for one of them Disclosure Coordinated privately with the Flatpak maintainers through the freedesktop.org security list, published as a GitHub Security Advisory with a CVE assigned and announced on the project's announcement list alongside a fixed release in the supported stable series. Desktop distributions ship the update quickly given the exposure, so the practical embargo runs to that coordinated release rather than to a fixed day count. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability