Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M
CVE-2026-34079Flatpak affected by arbitrary file deletion on the host filesystem
High 7.5
In plain English
A high-severity path traversal in flatpak from flatpak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | flatpak | 1.16.0-9.el10_2.1 | ALSA-2026:21757 |
| AlmaLinux:8 | flatpak | 1.12.9-4.el8_10 | ALSA-2026:21756 |
| AlmaLinux:9 | flatpak | 1.12.9-4.el9_8.1 | ALSA-2026:21755 |
| AlmaLinux:10 | flatpak-devel | 1.16.0-9.el10_2.1 | ALSA-2026:21757 |
| AlmaLinux:8 | flatpak-devel | 1.12.9-4.el8_10 | ALSA-2026:21756 |
| AlmaLinux:9 | flatpak-devel | 1.12.9-4.el9_8.1 | ALSA-2026:21755 |
| AlmaLinux:10 | flatpak-libs | 1.16.0-9.el10_2.1 | ALSA-2026:21757 |
| AlmaLinux:8 | flatpak-libs | 1.12.9-4.el8_10 | ALSA-2026:21756 |
| AlmaLinux:9 | flatpak-libs | 1.12.9-4.el9_8.1 | ALSA-2026:21755 |
| AlmaLinux:10 | flatpak-selinux | 1.16.0-9.el10_2.1 | ALSA-2026:21757 |
| AlmaLinux:8 | flatpak-selinux | 1.12.9-4.el8_10 | ALSA-2026:21756 |
| AlmaLinux:9 | flatpak-selinux | 1.12.9-4.el9_8.1 | ALSA-2026:21755 |
| AlmaLinux:10 | flatpak-session-helper | 1.16.0-9.el10_2.1 | ALSA-2026:21757 |
| AlmaLinux:8 | flatpak-session-helper | 1.12.9-4.el8_10 | ALSA-2026:21756 |
| AlmaLinux:9 | flatpak-session-helper | 1.12.9-4.el9_8.1 | ALSA-2026:21755 |
| Alpine:v3.23 | flatpak | 1.16.4-r0 | ALPINE-CVE-2026-34079 |
| Alpine:v3.24 | flatpak | 1.16.4-r0 | ALPINE-CVE-2026-34079 |
| Debian:12 | flatpak | 1.14.10-1~deb12u2 | DEBIAN-CVE-2026-34079 |
| Debian:13 | flatpak | 1.16.6-1~deb13u1 | DEBIAN-CVE-2026-34079 |
| Debian:14 | flatpak | 1.16.4-1 | DEBIAN-CVE-2026-34079 |
| Rocky Linux:10 | flatpak | 0:1.16.0-9.el10_2.1 | RLSA-2026:21757 |
| Rocky Linux:8 | flatpak | 0:1.12.9-4.el8_10 | RLSA-2026:21756 |
| Rocky Linux:9 | flatpak | 0:1.12.9-4.el9_8.1 | RLSA-2026:21755 |
| Ubuntu:25.10 | flatpak | no fix listed | UBUNTU-CVE-2026-34079 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp x_refsource_CONFIRM