Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M
CVE-2026-55888XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
High 8.8
In plain English
A high-severity path traversal in xdg-desktop-portal from flatpak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | xdg-desktop-portal | no fix listed | DEBIAN-CVE-2026-55888 |
| Debian:13 | xdg-desktop-portal | no fix listed | DEBIAN-CVE-2026-55888 |
| Debian:14 | xdg-desktop-portal | 1.22.1+ds-1 | DEBIAN-CVE-2026-55888 |
| Ubuntu:22.04:LTS | xdg-desktop-portal | no fix listed | UBUNTU-CVE-2026-55888 |
| Ubuntu:24.04:LTS | xdg-desktop-portal | no fix listed | UBUNTU-CVE-2026-55888 |
| Ubuntu:26.04:LTS | xdg-desktop-portal | no fix listed | UBUNTU-CVE-2026-55888 |
| Ubuntu:26.10 | xdg-desktop-portal | no fix listed | UBUNTU-CVE-2026-55888 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| flatpak | xdg-desktop-portal | < 1.22.1 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N