Bubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonce#sandbox
Flatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpit