← Vulnerability feed

Vulnerability record · CVE-2026-34078 · published 7 April 2026

CVE-2026-34078: Flatpak link following vulnerability

Flatpak · Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

9.3 CVSS 4.0 Critical EPSS 0.90% · top 42.0% CWE-61 · CWE-61CWE-59 · Link following
9.3CVSS 4.0 base score
0.90%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
17References
24 Jul 2026Last modified by NVD

Description

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/8 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/10/14 Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:21755
https://access.redhat.com/errata/RHSA-2026:21756
https://access.redhat.com/errata/RHSA-2026:21757
https://access.redhat.com/errata/RHSA-2026:23417
https://access.redhat.com/errata/RHSA-2026:23418
https://access.redhat.com/errata/RHSA-2026:23419
https://access.redhat.com/errata/RHSA-2026:23420
https://access.redhat.com/errata/RHSA-2026:25068
https://access.redhat.com/errata/RHSA-2026:25381
https://access.redhat.com/errata/RHSA-2026:30901
https://access.redhat.com/errata/RHSA-2026:35843
https://access.redhat.com/security/cve/CVE-2026-34078
https://bugzilla.redhat.com/show_bug.cgi?id=2456276
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34078.json

Track CVE-2026-34078 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-42472Flatpak injection vulnerabilityFlatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app us…EPSS 1.3%9.0CVE-2019-10063Flatpak improper input validation vulnerabilityFlatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-522…EPSS 1.9%8.8CVE-2021-21261Flatpak injection vulnerabilityFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` ser…EPSS 0.57%8.8CVE-2018-6560Flatpak interpretation conflict vulnerabilityIn dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break ou…EPSS 0.41%8.7CVE-2026-34079Flatpak path traversal vulnerabilityFlatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without pro…EPSS 0.44%8.6CVE-2021-43860Flatpak improper privilege management vulnerabilityFlatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the…EPSS 1.3%8.4CVE-2024-32462Flatpak argument injection vulnerabilityFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1…EPSS 0.51%8.2CVE-2021-21381Flatpak injection vulnerabilityFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before versi…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2026-34078), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.