CVE-2026-34078

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-34078: backport the AlmaLinux/RHSA-2026:21755 fix series (29 commits + libglnx-chase update) to defeat sandbox-expose symlink races; preserves 1.12.7 baseline.

• fix CVE-2026-34078 flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options

• CVE-2026-34078: fix the portal sandbox-expose symlink refusal, which never triggered because O_PATH|O_NOFOLLOW opens the symlink instead of failing
• Raise the release to 13.0.1 and build every shared EL7 target with dist .el7_9, so the package outranks the vendor releases on oraclelinux7els (13.0.1.el7_9, ELSCVE-228058) and rhel7els (13.el7_9, ELSCVE-228171)

• CVE-2026-34078: fix the portal sandbox-expose symlink refusal, which never triggered because O_PATH|O_NOFOLLOW opens the symlink instead of failing
• Raise the release to 13.0.1 and build every shared EL7 target with dist .el7_9, so the package outranks the vendor releases on oraclelinux7els (13.0.1.el7_9, ELSCVE-228058) and rhel7els (13.el7_9, ELSCVE-228171)

Complete sandbox escape leading to host file access and code execution in the host context. (CVE-2026-34078) Arbitrary file deletion on the host filesystem. (CVE-2026-34079)

These are all security issues fixed in the flatpak-1.16.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host file access and code execution in the host context (bsc#1261769).
• CVE-2026-34079: improper removal of outdated cache files allows for arbitrary file deletion on the host filesystem (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
• CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
• CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
• CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
• CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
• CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
• CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
• CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
• CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
• CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

• Update to version 1.16.6 (jsc#PED-17048):

• Fix file descriptor leaks affecting Chromium-based browsers.
• Fix installing extra-data without a runtime, including OpenH264.
• Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
• Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.

• Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
• Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
• Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.

It was discovered that Flatpak did not properly validate paths in sandbox-expose options. A malicious or compromised Flatpak app could use app-controlled symlinks to access arbitrary host files and gain code execution in the host context. This issue was addressed in Ubuntu Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-34078)

It was discovered that Flatpak did not properly validate paths when
removing outdated ld.so cache files. A malicious or compromised Flatpak app could use this issue to delete arbitrary files on the host. (CVE-2026-34079)