CVE-2026-55888
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileChooser.SaveFiles to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). Filenames are not validated by the frontend or common backends, which are supposed to check that the file does not already exist.
Risk Assessment
Potential creation or overwrite of files on the host within the user's privileges, which may lead to unauthorized data modification.
Recommendation
Update XDG Desktop Portal to version 1.22.1 or later, which contains the fix for this issue.
Other vulnerabilities in XDG Desktop Portal
See all- CVE-2026-55889High
In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileTransfer.RetrieveFiles to redirect drag-and-drop and copy-paste data intended for other applications to themselves. Access tokens were generated with g_random_int or g_uuid_string_random based on Mersenne Twister, allowing recovery of PRNG state and prediction of subsequent tokens.
- CVE-2026-40354Low
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. The vulnerability is fixed in 1.20.4 and 1.21.1.
Original NVD description (English source)
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS