VDB
CVE-2026-40354
CVE-2026-40354
PUBLISHED
CVSS 2.9000000953674316 LOW
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
EPSS 0.13% · 2.7th percentile
Risk Scores
CVSS 3.1
2.9000000953674316
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.13%
2.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flatpak | xdg-desktop-portal | 0, 1.21.0 |
Timeline
- Apr 11, 2026 EPSS Score
- Apr 11, 2026 CVE Published
- Apr 11, 2026 Security Advisory
- Apr 15, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
References
- https://www.openwall.com/lists/oss-security/2026/04/10/14 url
- https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj url
- https://nvd.nist.gov/vuln/detail/CVE-2026-40354 advisory
- https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1 fix
- https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4 fix