9.3
Critical
CVE-2026-34078 Flatpak is a Linux application sandboxing and distribution framework
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| flatpak 1.16 | earliest → < 1.16.4 | 1.16.4 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Versions not published |
Show the 27 other branches Hide the 27 other branches
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of flatpak
The 15 CVEs of flatpak →
CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
7.2
High
CVE-2026-96808
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from…
7.4
High
CVE-2026-96807
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing…
4.0
Medium
CVE-2026-90616
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host,…
7.4
High