Vulnerabilities

XDG Desktop Portal is a desktop integration portal.

XDG Desktop Portal is a desktop integration portal.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal ..

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location.

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026…

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

flatpak-builder is a tool to build flatpaks from source.

Flatpak is a Linux application sandboxing and distribution framework.

Flatpak is a Linux application sandboxing and distribution framework.

xdg-dbus-proxy is a filtering proxy for D-Bus connections.

Flatpak is a Linux application sandboxing and distribution framework.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak is a Linux application sandboxing and distribution framework.

Flatpak is a Linux application sandboxing and distribution framework.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass.

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not ident…

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable.