VYPR
← All advisories
Low severity2.9NVD Advisory· Published Apr 11, 2026· Updated Apr 27, 2026

CVE-2026-40354

CVE-2026-40354

Description

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Flatpak/Xdg Desktop Portal3 versions
    cpe:2.3:a:flatpak:xdg-desktop-portal:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:flatpak:xdg-desktop-portal:*:*:*:*:*:*:*:*range: <1.20.4
    • cpe:2.3:a:flatpak:xdg-desktop-portal:1.21.0:*:*:*:*:*:*:*
    • (no CPE)range: <1.20.4, <1.21.1

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.