USN-8287-2
xdg-desktop-portal regression
USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the fix for CVE-2026-40354 was incomplete and introduced a regression when trashing files. This update fixes the problem and provides the corresponding update for Ubuntu 26.04 LTS.
We apologize for the inconvenience.
Original advisory details:
It was discovered that XDG Desktop Portal incorrectly handled trashing files. A local attacker could possibly use this issue to delete arbitrary files on the host file system via a symlink attack.
What each source reports
OSVNo score
xdg-desktop-portal regression
USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the fix for CVE-2026-40354 was incomplete and introduced a regression when trashing files. This update fixes the problem and provides the corresponding update for Ubuntu 26.04 LTS.
We apologize for the inconvenience.
Original advisory details:
It was discovered that XDG Desktop Portal incorrectly handled trashing files. A local attacker could possibly use this issue to delete arbitrary files on the host file system via a symlink attack.
- Record
USN-8287-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xdg-desktop-portalUbuntu:24.04:LTS | before 1.18.4-1ubuntu2.24.04.3, plus listed versions 1.18.0-1ubuntu11.18.2-1ubuntu11.18.2-1ubuntu31.18.2-1ubuntu41.18.3-1ubuntu11.18.4-1ubuntu21.18.4-1ubuntu2.24.04.11.18.4-1ubuntu2.24.04.2 | 1.18.4-1ubuntu2.24.04.3 |
xdg-desktop-portalUbuntu:26.04:LTS | before 1.21.1+ds-1ubuntu3.1, plus listed versions 1.20.3+ds-1ubuntu11.20.3+ds-1ubuntu21.21.0+ds-1ubuntu31.21.0+ds-1ubuntu41.21.0+ds-1ubuntu6 Show 5 moreShow less1.21.0+ds-1ubuntu71.21.0+ds-1ubuntu81.21.1+ds-1ubuntu11.21.1+ds-1ubuntu21.21.1+ds-1ubuntu3 | 1.21.1+ds-1ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8287-2 is a vulnerability with no CVSS score yet in xdg-desktop-portal, published September 23, 2026. No source lists public exploit code. Fixed in xdg-desktop-portal 1.18.4-1ubuntu2.24.04.3.