8.7
High
CVE-2026-34079 Flatpak is a Linux application sandboxing and distribution framework
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| flatpak 1.16 | earliest → < 1.16.4 | 1.16.4 |
Other CVEs of flatpak
The 15 CVEs of flatpak →
CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
7.2
High
CVE-2026-96808
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from…
7.4
High
CVE-2026-96807
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing…
4.0
Medium
CVE-2026-90616
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host,…
7.4
High