Vendor
A vulnerability in Flatpak's extract_extra_data() allows malicious repositories to perform path traversal and write arbitrary files to the host filesystem, potentially leading to root access on system-wide installations.