High severity · published Apr 7, 2026
CVE-2026-34079
Flatpak affected by arbitrary file deletion on the host filesystem
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
flatpak · flatpak
< 1.16.4 · source: vendor, NVD
In the news
VulnerabilityCritical
Flatpak 1.16.4 fixes sandbox escape and three other security flaws
Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078. File system exposure Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2fxp-43j9-pwvc prevents arbitrary read-access to files in the system-helper context. The fourth fix, … More →
The post Flatpak 1.16.4 fixes sandbox escape and three other security flaws appeared first on Help Net Security .
Apr 8, 2026·Help Net Security
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34079
Vendor Advisory
https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp
More from flatpak
10.0
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
10.0
CVE-2024-42472
Flatpak is a Linux application sandboxing and distribution framework
9.0
CVE-2019-10063
Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass
8.8
CVE-2021-21261
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
8.8
CVE-2018-6560
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because…