CVE-2017-9780: In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with...

Security readout for executives and security teams

Flatpak before 0.8.7 could install malicious third-party apps with unsafe file permissions. If an organization allowed untrusted Flatpak repositories, a local user could potentially run privileged files or modify writable locations. The worst case named in the sources is setuid root files when installed through the system helper. Exposure is most likely on Linux systems running Flatpak before 0.8.7, especially where third-party Flatpak repositories are configured or users can install apps from them. Treat as a targeted local privilege risk, not an internet-scale emergency. Prioritize shared Linux workstations, developer machines, and systems where users install Flatpak apps from third-party repositories. Mitigation focus: Upgrade Flatpak to 0.8.7 or a vendor-supported fixed package.; Apply the Debian security update where Debian packages are used.; Remove or restrict untrusted third-party Flatpak repositories..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.