Host path disclosure via extension symlink traversal

Information disclosure in Flatpak on Red Hat Enterprise Linux allows attackers to enumerate host paths through a malicious extension. During application launch, host-side checks of .ref and merge_dirs follow extension-controlled symlinks, and merge_dirs listings become enumerable inside the sandbox; extension metadata also accepts paths that redirect mounts. Exploitation requires the malicious extension to be installed and used by a launched application.