Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
| Vendor | Product | Versions |
|---|---|---|
| flatpak | flatpak | < 1.16.4 |
Updated severity to HIGH, CVSS estimate to 8.0, added new CWE-367, and included a new tag.
Updated severity to HIGH, added CVSS estimate of 7.5, marked exploit as available, and added new tag for CVE-2026-34078.
Updated severity to CRITICAL, added new affected versions 1.16.5 and 1.17.5, and updated the patch available to 1.17.5.
Added CVE-2026-34078 to the description and included a new CWE-22.
Updated severity to CRITICAL, marked as actively exploited, and specified patch available in version 1.16.4.
Initial creation
