Critical Security Flaw in Flatpak: Arbitrary Code Execution and File Deletion Risks
Summary
ALSA-2026:21757: Important: flatpak security update. Affects flatpak versions < 1.16.0-9.el10_2.1. Fixed in 1.16.0-9.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package their applications along with all necessary dependencies, ensuring consistent behavior across different Linux distributions. However, recent vulnerabilities have been identified that could compromise the security of applications running in Flatpak environments.
Vulnerability Detail
The vulnerabilities identified in Flatpak include CVE-2026-34078, which allows for arbitrary code execution through crafted symlinks in sandbox-expose options, and CVE-2026-34079, which enables arbitrary file deletion on the host due to improper cache file path validation. These vulnerabilities can lead to severe security breaches, allowing attackers to execute malicious code or delete critical files on the host system.
How To Fix
Minimum fixed version
1.16.0-9.el10_2.1
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of sandbox-expose options and avoid using crafted symlinks until the update is applied. Additionally, reviewing and validating cache file paths can help reduce the risk of arbitrary file deletion.
Conclusion
The identified vulnerabilities in Flatpak pose significant risks, including arbitrary code execution and file deletion. It is crucial for users to update their Flatpak installations to the latest patched version to ensure their systems remain secure. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, ensuring that applications run consistently across different environments.
The vulnerabilities include arbitrary code execution via crafted symlinks (CVE-2026-34078) and arbitrary file deletion due to improper cache file path validation (CVE-2026-34079).
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider limiting the use of sandbox-expose options and validating cache file paths to mitigate risks.
For more details, refer to the CVE pages for CVE-2026-34078 and CVE-2026-34079, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
