CVE-2026-34079
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Flatpak prior to version 1.16.4, the ld.so caching mechanism removes outdated cache files without verifying that the app-controlled path is within the cache directory. This allows Flatpak apps to delete arbitrary files on the host.
Risk Assessment
Flatpak applications can delete critical system files, potentially leading to system crashes or data loss.
Recommendation
Update Flatpak to version 1.16.4 or later.
Other vulnerabilities in Flatpak
See all- CVE-2017-9780High
In Flatpak before 0.8.7, third-party app repositories could include malicious apps with files having inappropriate permissions, such as setuid or world-writable. These files could be executed by a local attacker or allow writing to world-writable locations.
- CVE-2026-34078Critical
Flatpak prior to 1.16.4 contains a vulnerability where the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, giving apps access to all host files and can be used as a primitive to gain code execution in the host context.
Original NVD description (English source)
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.