Critical Security Flaw in Flatpak: Arbitrary Code Execution and File Deletion Vulnerabilities
Summary
ALSA-2026:21756: Important: flatpak security update. Affects flatpak versions < 1.12.9-4.el8_10. Fixed in 1.12.9-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a powerful system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package their applications with all necessary dependencies, ensuring consistent behavior across different Linux distributions. However, recent vulnerabilities have been identified that could allow malicious actors to exploit the system, leading to severe security risks.
Vulnerability Detail
The vulnerabilities identified in Flatpak include arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) and arbitrary file deletion on the host due to improper cache file path validation (CVE-2026-34079). These vulnerabilities arise from flaws in the way Flatpak handles symlinks and validates file paths, potentially allowing attackers to execute unauthorized code or delete critical files on the host system.
How To Fix
Minimum fixed version
1.12.9-4.el8_10
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of sandbox-expose options and avoid using symlinks in their Flatpak applications until the update is applied. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The identified vulnerabilities in Flatpak pose significant security risks, allowing for arbitrary code execution and file deletion. It is crucial for users to update their Flatpak installations to the latest version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, ensuring consistent behavior across different distributions.
The vulnerabilities include arbitrary code execution via crafted symlinks and arbitrary file deletion due to improper cache file path validation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, limit the use of sandbox-expose options and avoid symlinks in your applications until you can apply the update.
For detailed information, refer to the CVE pages for CVE-2026-34078 and CVE-2026-34079, which provide insights into the impact and technical details of the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
