{"id":1339,"date":"2026-08-11T15:00:00","date_gmt":"2026-08-11T15:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/08\/11\/flatpak-1-18-1-schliesst-zehn-cves-sandbox-ausbruch\/"},"modified":"2026-08-17T23:09:53","modified_gmt":"2026-08-17T23:09:53","slug":"flatpak-1-18-1-schliesst-zehn-cves-sandbox-ausbruch","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/08\/11\/flatpak-1-18-1-schliesst-zehn-cves-sandbox-ausbruch\/","title":{"rendered":"Flatpak 1.18.1 schlie\u00dft zehn CVEs \u2013 Sandbox-Ausbruch"},"content":{"rendered":"<div id=\"netgu-3039199026\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Das Linux-Sandboxing-Framework Flatpak hat am 11. August 2026 die Sicherheitsversion 1.18.1 ver\u00f6ffentlicht. Sie behebt zehn CVEs \u2013 von einem vollst\u00e4ndigen Sandbox-Ausbruch mit Lese- und Schreibzugriff auf das gesamte Host-Dateisystem bis zur Ausweitung auf Root-Rechte. Betreiber und Nutzer sollten umgehend aktualisieren.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Die schwerwiegendsten L\u00fccken<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Sandbox-Ausbruch per Symlink:<\/strong> Ein b\u00f6sartiger Symlink in einem App-Datenverzeichnis konnte vollen Lese-\/Schreibzugriff auf das Host-Dateisystem gew\u00e4hren (GHSA-8688-9&#215;26-hhxj).<\/li>\n\n\n\n<li><strong>Root-Rechteausweitung:<\/strong> \u00dcber Pfad-Traversal in <code>revokefs<\/code> lie\u00df sich lokal Root erlangen.<\/li>\n\n\n\n<li><strong>Weitere:<\/strong> ein m\u00f6glicher Puffer\u00fcberlauf auf 32-Bit-Systemen sowie ein Umgehen der Anti-Downgrade-Richtlinie, mit dem unprivilegierte Nutzer System-Apps zur\u00fcckrollen konnten.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Besonders kritisch ist der Sandbox-Ausbruch, weil Flatpak gerade daf\u00fcr gedacht ist, nicht vertrauensw\u00fcrdige Anwendungen vom System zu isolieren. Wird diese Isolation durchbrochen, ist der Schutzgewinn dahin. Parallel zur stabilen 1.18.1 gibt es eine Vorabversion 1.19.0, die dieselben Fixes samt zus\u00e4tzlicher Funktionen b\u00fcndelt.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Was jetzt zu tun ist<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Das Update sollte auf allen Distributionen zeitnah eingespielt werden \u2013 besonders dort, wo OCI-Images oder nicht vertrauensw\u00fcrdige Anwendungen laufen. Flatpak-Pakete aktualisiert man mit <code>flatpak update<\/code>; das Framework selbst kommt \u00fcber den jeweiligen Distributions-Paketmanager. Ein anschlie\u00dfender Neustart der laufenden Flatpak-Apps stellt sicher, dass die gepatchte Laufzeit greift.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Quellen: <a href=\"https:\/\/www.linuxcompatible.org\/story\/flatpak-1181-and-1190-prerelease-fix-10-critical-cves-and-add-polkit-downgrade-support\" target=\"_blank\" rel=\"noopener\">linuxcompatible.org<\/a>, <a href=\"https:\/\/github.com\/flatpak\/flatpak\/releases\" target=\"_blank\" rel=\"noopener\">Flatpak auf GitHub<\/a>.<\/em><\/p>\n<div id=\"netgu-3671308446\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Flatpak 1.18.1 behebt zehn CVEs, darunter einen Sandbox-Ausbruch mit vollem Dateisystem-Zugriff und eine Root-Rechteausweitung. Update dringend empfohlen.<\/p>\n","protected":false},"author":1,"featured_media":1488,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-1339","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1339"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1339\/revisions"}],"predecessor-version":[{"id":1489,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1339\/revisions\/1489"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1488"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}