8.7
Élevée
CVE-2026-34079 Flatpak is a Linux application sandboxing and distribution framework
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| flatpak 1.16 | premières → < 1.16.4 | 1.16.4 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de flatpak
Les 15 CVE de flatpak →
CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
7.2
Élevée
CVE-2026-96808
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from…
7.4
Élevée
CVE-2026-96807
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing…
4.0
Moyenne
CVE-2026-90616
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host,…
7.4
Élevée