CVE-2026-55888
XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
CVE-2026-55888- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-108752
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
EUVD-2026-108752- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
CVE-2026-55888- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
CVE-2026-55888- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-55888
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
DEBIAN-CVE-2026-55888- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2026-2998
xdg-desktop-portal security update
xdg-desktop-portal works by exposing a series of D-Bus interfaces known as portals under a well-known name (org.freedesktop.portal.Desktop) and object path (/org/freedesktop/portal/desktop). The portal interfaces include APIs for file access, opening URIs, printing and others.
Security Fix(es):
(CVE-2026-55888)
- Record
OESA-2026-2998- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2026-2999
xdg-desktop-portal security update
xdg-desktop-portal works by exposing a series of D-Bus interfaces known as portals under a well-known name (org.freedesktop.portal.Desktop) and object path (/org/freedesktop/portal/desktop). The portal interfaces include APIs for file access, opening URIs, printing and others.
Security Fix(es):
(CVE-2026-55888)
- Record
OESA-2026-2999- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3000
xdg-desktop-portal security update
xdg-desktop-portal works by exposing a series of D-Bus interfaces known as portals under a well-known name (org.freedesktop.portal.Desktop) and object path (/org/freedesktop/portal/desktop). The portal interfaces include APIs for file access, opening URIs, printing and others.
Security Fix(es):
(CVE-2026-55888)
- Record
OESA-2026-3000- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-55888
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
- Record
UBUNTU-CVE-2026-55888- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVSUSE-SU-2026:5098-1 No score
Security update for xdg-desktop-portal
This update for xdg-desktop-portal fixes the following issues:
- CVE-2026-40354: file deletion via symlink attack (bsc#1262045).
- CVE-2026-55888: arbitrary file access due to
SaveFilesfilesoption path traversal (bsc#1287724). - CVE-2026-55889: drag-and-drop and copy-paste theft due to predictable
FileTransferkey (bsc#1287725).
- Record
SUSE-SU-2026:5098-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xdg-desktop-portalDebian:12 |
All versions, plus listed versions 1.16.0-21.16.0-31.17.0-11.17.1-11.17.2-1 Show 23 moreShow less1.18.0-11.18.1-11.18.2-11.18.3-11.18.4-11.18.4-21.19.0+ds-11.19.1+ds-11.19.2+ds-11.19.3+ds-11.19.4+ds-11.20.0+ds-11.20.0+ds-21.20.1+ds-11.20.1+ds-21.20.3+ds-11.20.3+ds-21.20.3+ds-31.20.4+ds-11.21.0+ds-11.21.1+ds-11.22.0+ds-11.22.1+ds-1 |
None known |
xdg-desktop-portalDebian:13 |
All versions, plus listed versions 1.20.3+ds-11.20.3+ds-21.20.3+ds-31.20.4+ds-11.21.0+ds-11.21.1+ds-11.22.0+ds-11.22.1+ds-1 |
None known |
xdg-desktop-portalDebian:14 |
before 1.22.1+ds-1, plus listed versions 1.20.3+ds-11.20.3+ds-21.20.3+ds-31.20.4+ds-11.21.0+ds-11.21.1+ds-11.22.0+ds-1 |
1.22.1+ds-1 |
xdg-desktop-portalopenEuler:24.03-LTS-SP1 |
before 1.20.4-2.oe2403sp1 | 1.20.4-2.oe2403sp1 |
xdg-desktop-portalopenEuler:24.03-LTS-SP3 |
before 1.20.4-2.oe2403sp3 | 1.20.4-2.oe2403sp3 |
xdg-desktop-portalopenEuler:24.03-LTS-SP4 |
before 1.20.4-2.oe2403sp4 | 1.20.4-2.oe2403sp4 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 3 CVEs |
before 1.16.0-150500.3.13.1 | 1.16.0-150500.3.13.1 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 3 CVEs |
before 1.16.0-150500.3.13.1 | 1.16.0-150500.3.13.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs |
before 1.16.0-150500.3.13.1 | 1.16.0-150500.3.13.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs |
before 1.16.0-150500.3.13.1 | 1.16.0-150500.3.13.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xdg-desktop-portalUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.3-0ubuntu0.0 |
None known |
xdg-desktop-portalUbuntu:18.04:LTS |
All versions, plus listed versions 0.8-20.8-30.9-10.9-20.10-0ubuntu1 Show 4 moreShow less0.10-20.10-40.11-11.0.3-0ubuntu0.2 |
None known |
xdg-desktop-portalUbuntu:20.04:LTS |
All versions, plus listed versions 1.4.2-21.4.2-31.6.0-11.6.0-1ubuntu11.6.0-1ubuntu2 |
None known |
xdg-desktop-portalUbuntu:22.04:LTS |
All versions, plus listed versions 1.8.1-1build11.10.1-21.10.1-41.12.1-11.12.1-1build1 Show 11 moreShow less1.12.1-1ubuntu11.14.1-11.14.1-21.14.2-11.14.2-1ubuntu11.14.2-1ubuntu21.14.3-0ubuntu21.14.3-0ubuntu2.22.04.11.14.4-1ubuntu1~22.04.11.14.4-1ubuntu2~22.04.11.14.4-1ubuntu2~22.04.2 |
None known |
xdg-desktop-portalUbuntu:24.04:LTS |
All versions, plus listed versions 1.18.0-1ubuntu11.18.2-1ubuntu11.18.2-1ubuntu31.18.2-1ubuntu41.18.3-1ubuntu1 Show 4 moreShow less1.18.4-1ubuntu21.18.4-1ubuntu2.24.04.11.18.4-1ubuntu2.24.04.21.18.4-1ubuntu2.24.04.3 |
None known |
xdg-desktop-portalUbuntu:26.10 |
All versions, plus listed versions 1.21.1+ds-1ubuntu31.21.1+ds-1ubuntu41.21.1+ds-1ubuntu51.21.1+ds-1ubuntu6 |
None known |
xdg-desktop-portalUbuntu:26.04:LTS |
All versions, plus listed versions 1.20.3+ds-1ubuntu11.20.3+ds-1ubuntu21.21.0+ds-1ubuntu31.21.0+ds-1ubuntu41.21.0+ds-1ubuntu6 Show 6 moreShow less1.21.0+ds-1ubuntu71.21.0+ds-1ubuntu81.21.1+ds-1ubuntu11.21.1+ds-1ubuntu21.21.1+ds-1ubuntu31.21.1+ds-1ubuntu3.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55888 is a high vulnerability (CVSS 8.8) in Flatpak Xdg-desktop-portal, published July 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in xdg-desktop-portal 1.22.1+ds-1.
References
github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-cm83-2936-gxjm
nvd.nist.gov/vuln/detail/CVE-2026-55888
security-tracker.debian.org/tracker/CVE-2026-55888
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2998
Show 11 moreShow less
suse.com/support/update/announcement/2026/suse-su-20265098-1
bugzilla.suse.com/1262045
ubuntu.com/security/CVE-2026-55888
cve.org/CVERecord?id=CVE-2026-55888