TI-2026-29129 Aliases CVE-2026-40354 GHSA-v5fw-rcv7-v6f3

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app…

LOW 27CWE-61Published 2026-04-11 · Updated 2026-04-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00128 2nd percentileScored 2026-11-07

Fix Partial xdg-desktop-portal (Flatpak): 1.20.4, 1.21.1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flatpak	xdg-desktop-portal	before 1.20.4; 1.21.0 to before 1.21.1	1.20.4, 1.21.1	Patch available	CNA

xdg-desktop-portal Vendorflatpak Affected before 1.20.4; 1.21.0 to before 1.21.1 Fixed in 1.20.4, 1.21.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:flatpak:xdg-desktop-portal::::::::	before 1.20.4	Vulnerable	flatpak
cpe:2.3:a:flatpak:xdg-desktop-portal:1.21.0:::::::*	1.21.0	Vulnerable	flatpak

cpe:2.3:a:flatpak:xdg-desktop-portal:*:*:*:*:*:*:*:* Versions before 1.20.4 Vulnerable ·flatpak
cpe:2.3:a:flatpak:xdg-desktop-portal:1.21.0:*:*:*:*:*:*:* Versions 1.21.0 Vulnerable ·flatpak

Remediation

Fix · CNA xdg-desktop-portal (Flatpak) Fixed in 1.20.4, 1.21.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-40354
2026-10-03 Alias added: GHSA-v5fw-rcv7-v6f3

References

Advisory 1

https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences