CVE-2026-55888 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-55888?
CVE-2026-55888 is a high-severity vulnerability in flatpak xdg-desktop-portal, published on 23 Oct 2026.
Official description
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-55888?
How do I fix CVE-2026-55888?
Upgrade to a fixed version.
Is CVE-2026-55888 being exploited?
There is no known exploitation of CVE-2026-55888 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-55888, GHSA-cm83-2936-gxjm, OESA-2026-2998, OESA-2026-2999, OESA-2026-3000, UBUNTU-CVE-2026-55888.