When extracting OCI layer archives, Flatpak rebases archive entry pathnames to the destination directory using g_build_filename, and sets ARCHIVE_EXTRACT_SECURE_NODOTDOT to reject .. components in both pathnames and hardlink targets. However, hardlink targets were not rebased to the destination directory. A crafted
archive entry with an absolute hardlink target (e.g. /etc/shadow) causes libarchive to call link() with that path directly, hardlinking the host file into the extraction directory and making its contents readable.

An attacker controlling an OCI registry can serve a crafted layer archive that exploits this during flatpak install or flatpak update.