In a corrective release of the standalone package system Flatpak 1.16.4 published a few hours ago, as well as in the experimental release 1.17.4, a vulnerability (CVE-2026-34078) has been addressed, which allows a malicious or compromised flatpak application to bypass the established sandbox isolation mode, access files in the main system, and execute arbitrary code outside the isolation mode. The issue has been assigned a critical severity level (9.3 out of 10).
The vulnerability exists in the D-Bus service flatpak-portal, which facilitates the launch of 'portals' used to organize access to resources from the main environment in isolated applications. The problem arises because the flatpak-portal service allows an application to specify file paths in the sandbox-expose options that, due to insufficient checks, can be symbolic links pointing to arbitrary parts of the filesystem.
Before mounting, the service reveals the symbolic link and mounts the path it points to in the sandbox environment, which allows bypassing isolation and gaining read and write access to host environment files. To execute its own code in the system, for example, one can add an autorun script such as '~/.bashrc' or '~/.profile', or modify the file '~/.ssh/authorized_keys' with SSH keys.
The status of the vulnerability's resolution in distributions can be assessed on the following pages (if the page is unavailable, it means the distribution developers have not yet begun to address the issue): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora. As a workaround for protection, the flatpak-portal service can be disabled: sudo systemctl --global mask flatpak-portal.service && systemctl --user stop flatpak-portal.service
In addition to the critical vulnerability, the new release addresses three more security issues:
- The possibility (CVE-2026-34079) of deleting arbitrary files in the host system's filesystem. The problem arises because flatpak does not check the actual presence of the deleted file in the cache directory when cleaning outdated ld.so cache.
- The possibility of reading arbitrary files in the context of system-helper on systems with an OCI image repository configured through manipulation with symbolic links.
- The ability to intervene in processing cancellation requests for applications, allowing one user to prevent another user from stopping the download.
Source: opennet.ru
