Flatpak · Flatpak · CVE-2021-21381
**Name of the Vulnerable Software and Affected Versions**
Flatpak versions 0.9.4 through 1.10.2
**Description**
The issue is related to the "file forwarding" feature in Flatpak, which can be exploited by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. This can be achieved by putting special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, tricking Flatpak into behaving as though the user had chosen to open a target file with their Flatpak app. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
**Recommendations**
For Flatpak versions 0.9.4 through 1.10.2, update to version 1.10.2 to resolve the issue.
As a temporary workaround, consider avoiding installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` to make sure that literal filenames do not follow `@@` or `@@u`.
Restrict access to the vulnerable "file forwarding" feature to minimize the risk of exploitation.