# Are AppImages a general security risk? **URL:** https://discuss.privacyguides.net/t/are-appimages-a-general-security-risk/37077 **Category:** Questions **Tags:** please-eli5 **Created:** 2026-04-12T19:30:39Z **Posts:** 25 ## Post 1 by @Kabo — 2026-04-12T19:30:39Z I have heard that AppImages depend on an outdated library. But I need AppImages for some application’s like Cryptomator, that are buggy as a Flatpak. Is it ok to have some AppImages on the system? --- ## Post 2 by @FranklyFlawless — 2026-04-12T20:31:27Z It depends on your threat model. --- ## Post 3 by @TheDoc — 2026-04-12T20:31:48Z It’s best to avoid them so I’d recommend reporting any bugs you find with the Flatpak to Cryptomator. In the meantime it might be better to install it from one of the repositories they endorse ([PPA, AUR, Nix](https://cryptomator.org/downloads/#linux)) if any of those apply to you. If your distro isn’t supported and you really wanted to avoid AppImages you _could_ mess with Distrobox, but it can take time to learn and has its own downsides. --- ## Post 4 by @anonymous595 — 2026-04-12T21:12:30Z I use Appimage to run many apps on various computers (PrismLauncher (because new versions don’t support offline bypass, but that’s not the topic), VeraCrypt (because updating manually is hell), StandardNotes and some more video/photo editing software) It is not “security nightmare” but it acts as raw BIN, so it _can_ abuse rights because of lack of sandbox and it is still “no trust = do not run” approach. P.S: Hashes and virustotal are always good approach, but this isn’t bulletproof. * * * Actually, I did _not_ found any serious problems with Cryptomator in flatpack version so far. --- ## Post 5 by @seize — 2026-04-12T22:04:22Z I believe much of the security concern brought up by @Kabo are around appimage reliance on the outdated and unmaintained _fuse2_ library, and not sandboxing concerns[[1]](#footnote-149385-1). * * * 1. Though sandboxing concerns are equally valid in my view [↩︎](#footnote-ref-149385-1) --- ## Post 6 by @anonymous595 — 2026-04-12T23:33:56Z Correct me if I wrong, but isn’t Cryptomator also use fuse2 to mount volumes? --- ## Post 7 by @seize — 2026-04-12T23:39:52Z As far as I can tell, no Cryptomator does not use _fuse2_ on Linux, and requires _fuse3_ instead. Reference: [Volume Types | Cryptomator Documentation](https://docs.cryptomator.org/desktop/volume-type/) > ## **Linux-Based OS** > > ### FUSE > > **Requirements:** Linux, `fuse3` installed > > FUSE on Linux works only if the `fuse3` package is installed. Luckily, `fuse3` comes pre-installed on many Linux distributions. Note: this requirement is separate from the appimage requirement for _fuse2_ to be installed. --- ## Post 8 by @Kabo — 2026-04-13T14:55:22Z > [@TheDoc](#): > > It’s best to avoid them so I’d recommend reporting any bugs you find with the Flatpak to Cryptomator But I need to get the job done and can’t wait till they someday patch the bug > [@TheDoc](#): > > In the meantime it might be better to install it from one of the repositories they endorse ([PPA, AUR, Nix](https://cryptomator.org/downloads/#linux)) if any of those apply to you. PPA seems like its an Ubuntu thing? The other two are specific to distro’s I don’t use. > [@TheDoc](#): > > you _could_ mess with Distrobox Isn’t this to much overhead? > [@anonymous595](#): > > It is not “security nightmare” but it acts as raw BIN, so it _can_ abuse rights because of lack of sandbox and it is still “no trust = do not run” approach. > [@seize](#): > > I believe much of the security concern brought up by @Kabo are around appimage reliance on the outdated and unmaintained _fuse2_ library, and not sandboxing concerns . Yes, although I prefer Flatpak mostly because of sandboxing, in the case of Cryptomator, it needs very strong permissions that allow sandbox escape anyway. So I wonder, is AppImage a security risk, even if you assume that the dev’s are not malicous? --- ## Post 9 by @any1 — 2026-04-13T16:57:47Z > [@seize](#): > > unmaintained _fuse2_ library The newer appimage runtime does not use fuse2 anymore. --- ## Post 10 by @Libre_Software_Enjoyer — 2026-04-13T21:08:04Z > [@FranklyFlawless](#): > > It depends on your threat model. I think every threat model should prefer not to use outdated libraries --- ## Post 11 by @FranklyFlawless — 2026-04-13T21:20:07Z Thank you for your perspective. --- ## Post 12 by @TheDoc — 2026-04-14T00:46:42Z > [@Kabo](#): > > But I need to get the job done and can’t wait till they someday patch the bug Report it and use the AppImage in the meantime? > [@Kabo](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/thedoc/48/15_2.png) TheDoc: > > > endorse ([PPA, AUR, Nix](https://cryptomator.org/downloads/#linux)) if any of those apply to you. > > PPA seems like its an Ubuntu thing? > > The other two are specific to distro’s I don’t use. > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/thedoc/48/15_2.png) TheDoc: > > > you _could_ mess with Distrobox > > Isn’t this to much overhead? I’m just presenting what officially endorsed packages they offer as alternatives. If you can’t or don’t want to use any of them, you’re obviously stuck with the AppImage (or an unofficial package which has its own risks) until they resolve the Flatpak bugs which can only happen if you report them. --- ## Post 13 by @winteranimal — 2026-04-14T06:48:37Z When in doubt, wrap it in a vm. Your distro should have boxes or virt-manager. --- ## Post 14 by @Kabo — 2026-04-15T15:18:54Z > [@seize](#): > > As far as I can tell, no Cryptomator does not use _fuse2_ on Linux, and requires _fuse3_ instead. > > Reference: [Volume Types | Cryptomator Documentation](https://docs.cryptomator.org/desktop/volume-type/) > > > ## **Linux-Based OS** > > > > ### FUSE > > > > **Requirements:** Linux, `fuse3` installed > > > > FUSE on Linux works only if the `fuse3` package is installed. Luckily, `fuse3` comes pre-installed on many Linux distributions. > > Note: this requirement is separate from the appimage requirement for _fuse2_ to be installed. > [@any1](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/seize/48/2843_2.png) seize: > > > unmaintained _fuse2_ library > > The newer appimage runtime does not use fuse2 anymore. So does the Cryptomator .AppImage use outdated libraries or not? --- ## Post 15 by @any1 — 2026-04-15T15:44:43Z Since it doesn’t specify --runtime-file, it uses the default runtime, which doesn’t use the unmaintained version. --- ## Post 16 by @Kabo — 2026-04-15T17:07:23Z I now tried to use the Cryptomator AppImage, but if I try to integrate it with AppImageLauncher it gives an error message “Failed to register AppImage in system via libappimage“. And if I try to run it without integration, just nothing happens. --- ## Post 17 by @byte — 2026-04-15T19:36:50Z > **[Install Gear Lever on Linux | Flathub](https://flathub.org/en/apps/it.mijorus.gearlever)** > > Manage AppImages This should help you --- ## Post 18 by @Libre_Software_Enjoyer — 2026-04-16T15:14:50Z > [@any1](#): > > Since it doesn’t specify --runtime-file, it uses the default runtime, which doesn’t use the unmaintained version. Is the default runtime distribution specific? --- ## Post 19 by @Expert4870 — 2026-04-16T15:23:39Z > **prism launcher** > > > [@anonymous595](#): > > > > PrismLauncher > > [Here](https://fmhy.net/gaming-tools#launchers) are some forks so you don’t need to use an old version. --- ## Post 20 by @any1 — 2026-04-16T15:57:13Z No, it depends on how the appimage was built by the developers. --- ## Post 21 by @Kabo — 2026-04-18T16:54:03Z > [@byte](#): > > [https://flathub.org/en/apps/it.mijorus.gearlever](https://flathub.org/en/apps/it.mijorus.gearlever) > > This should help you Thanks Does this work better then AppImageLauncher? Hav you tested it? --- ## Post 22 by @seize — 2026-04-18T17:06:27Z I can’t comment on if GearLever is _better_ than AppimageLauncher as i have not used AppimageLauncher in a couple years, but I will say GearLever is quite nice. See reference image: ![gearlever-example](https://forum-uploads.privacyguidesusercontent.com/original/3X/f/7/f72a1b67cb75fb7933656fb2ceffd832cfe50b8d.jpeg) --- ## Post 23 by @byte — 2026-04-18T17:46:39Z > [@Kabo](#): > > Hav you tested it? Of course I did. I use it pretty often. It even have auto update for appimage support feature --- ## Post 24 by @Libre_Software_Enjoyer — 2026-04-20T21:08:18Z > [@any1](#): > > No, it depends on how the appimage was built by the developers. So one would need to read the build script? --- ## Post 25 by @Kabo — 2026-05-06T23:02:02Z > [@byte](#): > > [https://flathub.org/en/apps/it.mijorus.gearlever](https://flathub.org/en/apps/it.mijorus.gearlever) > > This should help you > [@seize](#): > > I can’t comment on if GearLever is _better_ than AppimageLauncher as i have not used AppimageLauncher in a couple years, but I will say GearLever is quite nice. > > See reference image: > > ![gearlever-example](https://forum-uploads.privacyguidesusercontent.com/original/3X/f/7/f72a1b67cb75fb7933656fb2ceffd832cfe50b8d.jpeg) I have installed Cryptomator over GearLever and initially it didn’t open. But after I have uninstalled AppImage Launcher, removed Cryptomator, then restarted Linux and re installed Cryptomator with GearLever, its now working and even detects my USB drive.