Bubblewrap 0.12.0 stops symlink writes outside the sandbox

Bubblewrap 0.12.0 closes a symlink-traversal flaw that let an attacker controlling filesystem content redirect file creation outside the intended sandbox during setup. Simon McVittie reported the issue as GHSA-pxhw-h44j-8pfx; a CVE is requested but not yet assigned. Every earlier release is affected.

The problem surfaces when bubblewrap creates directories or files while preparing a container whose content comes from an untrusted source, such as a malicious or compromised app image. Symlinks in that content can point the new objects onto the host instead. Because the writes occur before any sandboxed process runs, they are not a runtime escape. The resulting files are owned by the user who launched bubblewrap, so the impact is unprivileged.

Flatpak is among the frameworks that can be hit this way when a bad app is installed. Other packaging systems that drive bubblewrap similarly face the same risk, depending on how much of the filesystem layout an attacker can influence. The 0.12.0 release blocks the traversal with openat2 and the RESOLVE_IN_ROOT flag (falling back on older kernels). That release drops setuid support, and the maintainers have not back-ported the change to earlier setuid builds; modern distributions that rely on unprivileged user namespaces are expected to move to the new version.