CVE-2026-34078

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.16.4

Description Flatpak is a Linux application sandboxing and distribution framework. A flaw exists where the Flatpak portal accepts paths in the sandbox-expose options that can be app-controlled symlinks pointing to arbitrary paths. Flatpak run mounts the resolved host path in the sandbox, potentially granting applications access to host files and enabling code execution in the host context. This allows a malicious or compromised application in flatpak format to bypass the established sandbox isolation, gain access to files in the main system, and execute arbitrary code outside of isolation.

Recommendations Update to Flatpak version 1.16.4 or later.