When Flatpak launches an application, it performs host-side file operations inside extension content directories to set up bind mounts and symlinks. These operations used path-based APIs that follow symlinks without confinement. Since an extension's files directory is entirely controlled by the extension developer, a malicious extension can place symlinks pointing at arbitrary host paths.

Specifically, Flatpak follows symlinks in the extension content when checking for the .ref lock marker file and when iterating merge_dirs directories. For merge_dirs, the host-side directory listing is reflected into the sandbox as symlinks that the application can enumerate, disclosing filenames from arbitrary host directories to the sandboxed application.

Separately, extension metadata fields (directory, subdir_suffix, add_ld_path, merge_dirs) were not validated for path traversal. Absolute paths or .. components in these fields can cause extension content to be mounted at unintended locations inside the sandbox, potentially overriding runtime directories.