CVE-2026-34078
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
Flatpak prior to 1.16.4 contains a vulnerability where the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, giving apps access to all host files and can be used as a primitive to gain code execution in the host context.
Risk Assessment
Risk includes complete sandbox escape, allowing apps to access all host files and potentially execute code on the host.
Recommendation
Immediately upgrade Flatpak to version 1.16.4 or later.
Original NVD description (English source)
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.