Arbitrary file write via .ld.so symlink substitution

Arbitrary file write in Flatpak before 1.18.1 allows local users controlling a sandboxed app to write fixed files outside its sandbox. The regenerate_ld_cache path follows a symlink substituted for ~/.var/app/$appid/.ld.so and writes its generated cache at the symlink target. A malicious sandboxed app is required, and the fixed filenames and content substantially constrain exploitation despite allowing writes anywhere its user can access.