Flatpak xdg-desktop-portal

• CVE-2026-55888 High 8.8 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal 0.4%
• CVE-2026-55889 High 8.3 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key 0.3%
• CVE-2026-40354 Low 2.9 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. 0.1%