{"id":"USN-8287-2","aliases":[],"status":"published","title":"xdg-desktop-portal regression","description":"USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the\nfix for CVE-2026-40354 was incomplete and introduced a regression when\ntrashing files. This update fixes the problem and provides the\ncorresponding update for Ubuntu 26.04 LTS.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that XDG Desktop Portal incorrectly handled\n trashing files. A local attacker could possibly use this issue to\n delete arbitrary files on the host file system via a symlink attack.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-23T18:40:07Z","modified":"2026-09-24T07:30:25Z","fixes":[{"ecosystem":"Ubuntu:24.04:LTS","package":"xdg-desktop-portal","fixed_in":["1.18.4-1ubuntu2.24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"xdg-desktop-portal","fixed_in":["1.21.1+ds-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1ubuntu2.24.04.3"}]}],"versions":["1.18.0-1ubuntu1","1.18.2-1ubuntu1","1.18.2-1ubuntu3","1.18.2-1ubuntu4","1.18.3-1ubuntu1","1.18.4-1ubuntu2","1.18.4-1ubuntu2.24.04.1","1.18.4-1ubuntu2.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1+ds-1ubuntu3.1"}]}],"versions":["1.20.3+ds-1ubuntu1","1.20.3+ds-1ubuntu2","1.21.0+ds-1ubuntu3","1.21.0+ds-1ubuntu4","1.21.0+ds-1ubuntu6","1.21.0+ds-1ubuntu7","1.21.0+ds-1ubuntu8","1.21.1+ds-1ubuntu1","1.21.1+ds-1ubuntu2","1.21.1+ds-1ubuntu3"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-8287-2","tags":["advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/xdg-desktop-portal/+bug/2166546","tags":["report"]}],"sources":{"osv":[{"id":"USN-8287-2","title":"xdg-desktop-portal regression","description":"USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the\nfix for CVE-2026-40354 was incomplete and introduced a regression when\ntrashing files. This update fixes the problem and provides the\ncorresponding update for Ubuntu 26.04 LTS.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that XDG Desktop Portal incorrectly handled\n trashing files. A local attacker could possibly use this issue to\n delete arbitrary files on the host file system via a symlink attack.","status":"published","published":"2026-09-23T18:40:07Z","modified":"2026-09-24T07:30:25.091699275Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}