Flatpak

Products

Exploited and recent CVEs

• CVE-2026-55888 High 8.8 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal 0.4%
• CVE-2026-55889 High 8.3 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key 0.3%
• CVE-2026-92162 High 7.2 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream 0.2%
• CVE-2026-96808 High 7.4 In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did n 0.1%
• CVE-2026-96807 Medium 4.0 In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content 0.1%
• CVE-2026-90616 High 7.4 In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnera 0.2%
• CVE-2026-40354 Low 2.9 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. 0.1%
• CVE-2026-39977 High 7.1 flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files 0.3%
• CVE-2026-34079 High 7.5 Flatpak affected by arbitrary file deletion on the host filesystem 0.3%
• CVE-2026-34078 Critical 9.0 Flatpak has a complete sandbox escape leading to host file access and code execution in the host context 1.7%
• CVE-2026-34080 Medium 6.8 xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception 0.2%
• CVE-2024-42472 Critical 10.0 Flatpak may allow access to files outside sandbox for certain apps 1.3%
• CVE-2024-32462 High 8.4 Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing 0.5%
• CVE-2023-28101 Medium 5.0 Flatpak metadata with ANSI control codes can cause misleading terminal output 0.9%
• CVE-2023-28100 Critical 10.0 TIOCLINUX can send commands outside sandbox if running on a virtual console 0.9%
• CVE-2022-21682 High 7.7 flatpak-builder can access files outside the build directory. 1.8%
• CVE-2021-43860 High 8.2 Permissions granted to applications can be hidden from the user at install time 1.4%
• CVE-2021-41133 High 8.8 Sandbox bypass via recent VFS-manipulating syscalls 0.4%
• CVE-2021-21381 High 7.1 Sandbox escape via special tokens in .desktop file 1.5%
• CVE-2021-21261 High 7.3 Flatpak sandbox escape via spawn portal 0.6%