CVE-2026-40354

EUVD-2026-21625
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
Symlink
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.9 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Affected Products (NVD)
VendorProductVersion
flatpakxdg-desktop-portal
𝑥
< 1.20.4
flatpakxdg-desktop-portal
1.21.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xdg-desktop-portal
bookworm
no-dsa
bullseye
postponed
forky
1.20.4+ds-1
fixed
sid
1.20.4+ds-1
fixed
trixie
no-dsa
Common Weakness Enumeration
References
https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4
https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1
https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj
https://www.openwall.com/lists/oss-security/2026/04/10/14