2.9
Low
CVE-2026-40354 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host…
Description
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| xdg-desktop-portal 1.21 | 1.21.0 → < 1.21.1 | 1.21.1 |
| xdg-desktop-portal 1.20 | earliest → < 1.20.4 | 1.20.4 |