PT-2026-31025
CVE-2026-34079
·
Published
2026-04-07
·
Updated
2026-10-20
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Flatpak versions prior to 1.16.4
Description
Flatpak, a Linux application sandboxing and distribution framework, contained a flaw where the caching mechanism for ld.so did not adequately verify that an application-controlled path to an outdated cache resided within the cache directory. This allowed Flatpak applications to delete arbitrary files on the host system.
Recommendations
Update to Flatpak version 1.16.4 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾