Flatpak - vulnerabilities (CVEs)
24 CVEs in 4 products, 3 in the last 30 days, newest from 2026-10-23.
Products
- Flatpak - 18 CVEs
- Xdg-desktop-portal - 3 CVEs
- Flatpak-builder - 2 CVEs
- Xdg-dbus-proxy - 1 CVEs
Newest CVEs of Flatpak
- CVE-2026-55888 - CVSS 8.8 (high), 2026-10-23: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain…
- CVE-2026-55889 - CVSS 8.3 (high), 2026-10-23: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to…
- CVE-2026-92162 - CVSS 7.2 (high), 2026-10-20: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one…
- CVE-2026-96808 - CVSS 7.4 (high), 2026-09-23: In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by…
- CVE-2026-96807 - CVSS 4 (medium), 2026-09-23: In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an…
- CVE-2026-90616 - CVSS 7.4 (high), 2026-09-12: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code…
- CVE-2026-40354 - CVSS 6.3 (medium), 2026-04-11: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on…
- CVE-2026-39977 - CVSS 7.1 (high), 2026-04-09: flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined…
- CVE-2026-34079 - CVSS 8.7 (high), 2026-04-07: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly…
- CVE-2026-34078 - CVSS 10 (critical), 2026-04-07: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which…
- CVE-2026-34080 - CVSS 6.8 (medium), 2026-04-07: xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy…
- CVE-2024-42472 - CVSS 10 (critical), 2024-08-15: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using…
- CVE-2024-32462 - CVSS 8.4 (high), 2024-04-18: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a…
- CVE-2023-28100 - CVSS 10 (critical), 2023-03-16: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4…
- CVE-2023-28101 - CVSS 5 (medium), 2023-03-16: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4,…
- CVE-2022-21682 - CVSS 7.7 (high), 2022-01-13: Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6.…
- CVE-2021-43860 - CVSS 8.6 (high), 2022-01-12: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the…
- CVE-2021-41133 - CVSS 8.8 (high), 2021-10-08: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with…
- CVE-2021-21381 - CVSS 8.2 (high), 2021-03-11: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2…
- CVE-2021-21261 - CVSS 8.8 (high), 2021-01-14: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that…
- CVE-2019-10063 - CVSS 9 (critical), 2019-03-26: Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by…
- CVE-2019-8308 - CVSS 8.2 (high), 2019-02-12: Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side…
- CVE-2018-6560 - CVSS 8.8 (high), 2018-02-02: In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the…
- CVE-2017-9780 - CVSS 7.8 (high), 2017-06-21: In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or…
