CVE-2026-40354

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-11 · updated 2026-10-26
Weakness: CWE-61

Description

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

Affected products

flatpak xdg-desktop-portal: before 1.20.4; 1.21.0 — fixed in 1.20.4

How to fix

Upgrade to a fixed version: flatpak xdg-desktop-portal 1.20.4. Check the vendor advisory for mitigations.

References

https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4
https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1
https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj
https://www.openwall.com/lists/oss-security/2026/04/10/14

Get alerted when CVE-2026-40354 or the next vulnerability affects your stack