Skip to content
Flatpak vulnerabilities
Newest
-
flatpak xdg-desktop-portal
XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
CVE-2026-55889
Fix available
8.3 High
-
flatpak
Important: flatpak security update
CVE-2026-96808
Fix available
7.4 High
-
flatpak
flatpak: Fix of CVE-2026-96807
CVE-2026-96807
Fix available
4.0 Medium
-
flatpak
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
CVE-2026-92162
Public exploitFix available
7.2 High
-
flatpak
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to...
CVE-2026-90616
Fix available
7.4 High
-
flatpak xdg-desktop-portal
XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
CVE-2026-55888
Fix available
8.8 High
-
flatpak xdg-desktop-portal
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash...
CVE-2026-40354
Fix available
2.9 Low
-
flatpak flatpak-builder
flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files
CVE-2026-39977
Fix available
7.1 High
-
flatpak
Flatpak affected by arbitrary file deletion on the host filesystem
CVE-2026-34079
Fix available
8.7 High
-
flatpak, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 more
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
CVE-2026-34078
Fix available
9.3 Critical
-
flatpak xdg-dbus-proxy
xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception
CVE-2026-34080
Fix available
6.8 Medium
-
debian linux, flatpak +1 more
Flatpak may allow access to files outside sandbox for certain apps
CVE-2024-42472
Fix available
10.0 Critical
-
flatpak, fedoraproject fedora +1 more
Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
CVE-2024-32462
Public exploitFix available
8.4 High
-
flatpak
Flatpak metadata with ANSI control codes can cause misleading terminal output
CVE-2023-28101
Fix available
5.0 Medium
-
flatpak
TIOCLINUX can send commands outside sandbox if running on a virtual console
CVE-2023-28100
Fix available
10.0 Critical
-
debian linux, flatpak, flatpak flatpak-builder +2 more +4 more
flatpak-builder can access files outside the build directory.
CVE-2022-21682
Fix available
7.7 High
-
debian linux, flatpak, fedoraproject fedora +1 more +3 more
Permissions granted to applications can be hidden from the user at install time
CVE-2021-43860
Fix available
8.2 High
-
debian linux, flatpak, fedoraproject fedora +2 more
Sandbox bypass via recent VFS-manipulating syscalls
CVE-2021-41133
Fix available
8.8 High
-
debian linux, flatpak, fedoraproject fedora +2 more
Sandbox escape via special tokens in .desktop file
CVE-2021-21381
Fix available
7.1 High
-
debian linux, flatpak +1 more
Flatpak sandbox escape via spawn portal
CVE-2021-21261
Fix available
7.3 High
-
flatpak
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox...
CVE-2019-10063
Fix available
9.0 Critical
-
flatpak, debian linux, redhat enterprise linux desktop +5 more +7 more
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script...
CVE-2019-8308
Fix available
8.2 High
-
flatpak, redhat enterprise linux desktop, enterprise linux server +4 more +6 more
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3,...
CVE-2018-6560
Fix available
8.8 High
-
flatpak, debian linux +1 more
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain...
CVE-2017-9780
Fix available
7.8 High