CVE-2026-34079

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)
• flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-34079: restrict cached-file removal to alphanumeric targets in flatpak_switch_symlink_and_remove to prevent path-traversal unlink via a sandboxed-app-controlled symlink

• CVE-2026-34079: prevent arbitrary file deletion via ld.so cache symlink

• CVE-2026-34079: fix arbitrary host file deletion via app-controlled ld.so cache symlink in flatpak_switch_symlink_and_remove

Complete sandbox escape leading to host file access and code execution in the host context. (CVE-2026-34078) Arbitrary file deletion on the host filesystem. (CVE-2026-34079)

These are all security issues fixed in the flatpak-1.16.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host file access and code execution in the host context (bsc#1261769).
• CVE-2026-34079: improper removal of outdated cache files allows for arbitrary file deletion on the host filesystem (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
• CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
• CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
• CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
• CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
• CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
• CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
• CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
• CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
• CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

• Update to version 1.16.6 (jsc#PED-17048):

• Fix file descriptor leaks affecting Chromium-based browsers.
• Fix installing extra-data without a runtime, including OpenH264.
• Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
• Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.

• Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
• Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
• Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.

It was discovered that Flatpak did not properly validate paths in sandbox-expose options. A malicious or compromised Flatpak app could use app-controlled symlinks to access arbitrary host files and gain code execution in the host context. This issue was addressed in Ubuntu Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-34078)

It was discovered that Flatpak did not properly validate paths when
removing outdated ld.so cache files. A malicious or compromised Flatpak app could use this issue to delete arbitrary files on the host. (CVE-2026-34079)