CVE-2026-40354 Flatpak CVE debrief

Who should care

Defenders managing systems with Flatpak and xdg-desktop-portal installed should assess exposure, especially in environments where untrusted Flatpak apps are used. This includes reviewing installed versions and applying patches as necessary.

Why it matters

CVE-2026-40354 is a Low-severity vulnerability in Flatpak's xdg-desktop-portal that allows any Flatpak app to delete files in the host context. Defenders should verify and apply patches, restrict untrusted apps, and monitor for potential attacks.

• Verify and apply patches to prevent exploitation.
• Restrict untrusted Flatpak apps from running in sensitive environments.
• Monitor for potential symlink attacks in host contexts.

Technical summary

The vulnerability exists in the xdg-desktop-portal component of Flatpak, allowing any Flatpak app to delete files in the host context via a symlink attack on g_file_trash. This issue is rated with a CVSS score of 2.9, indicating Low severity. The CVSS vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting the attack complexity and impact. The vulnerability is caused by a lack of proper validation of file paths, allowing an attacker to create a symlink to a file in the host context, which can then be deleted by the Flatpak app. This can lead to data loss and potentially allow an attacker to gain further access to the system.

Defensive priority

Defenders should prioritize verifying and applying patches for xdg-desktop-portal, especially in environments where untrusted Flatpak apps are used.

Recommended defensive actions

• Verify and apply patches for xdg-desktop-portal, specifically versions 1.20.4 and 1.21.1.
• Restrict untrusted Flatpak apps from running in environments where file deletion could cause significant impact.
• Monitor for and respond to potential symlink attacks in host contexts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. Vendor advisories and release notes for versions 1.20.4 and 1.21.1 offer remediation guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.