VulnSocial

CVE-2026-40354Disclosure(flatpak / xdg-desktop-portal)

LOWCVSS 6.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

flatpak CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-61

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • xdg-desktop-portal

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
flatpak
Products
xdg-desktop-portal

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-19: 1Technical Details · 2026-04-19: 104-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • CVE@CVEnew
    Disclosure

    CVE-2026-40354 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. https://www.cve.org/CVERecord?id=CVE-2026-40354

    Post summary

    The tweet announces CVE‑2026‑40354, stating that Flatpak xdg‑desktop‑portal versions before 1.20.4 and 1.21.x before 1.21.1 allow any Flatpak app to trash host files via a symlink attack on g_file_trash. No PoC, exploit, active usage, patch, or false‑positive claim is presented.

    01010151
    57.2K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appflatpakxdg-desktop-portal---
Appflatpakxdg-desktop-portal1.21.0--

Explore more

Back to dashboardflatpak CVEsxdg-desktop-portal vulnerabilities