CVE-2026-40354 Path traversal in xdg-desktop-portal
A malicious Flatpak application can trash arbitrary files on the host system via a symlink attack, requiring users to update xdg-desktop-portal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40354?
CVE-2026-40354 is a low-severity path traversal vulnerability in Flatpak xdg-desktop-portal, published on 11 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
Weakness: CWE-61
Which versions are affected by CVE-2026-40354?
It affects 1 product.
Linux distribution packages (1)
xdg-desktop-portal SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.18.2-150600.4.6.1 |
Products include Flatpak Xdg-Desktop-Portal.
How do I fix CVE-2026-40354?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40354 being exploited?
There is no known exploitation of CVE-2026-40354 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-40354, GHSA-rqr9-jwwf-wxgj, GHSA-v5fw-rcv7-v6f3, OESA-2026-2182, OESA-2026-2183, OESA-2026-2184 and 2 more.