CVE-2026-40354

Опубликовано: 11 апр. 2026

Источник: nvd

CVSS3: 2.9

CVSS3: 6.3

EPSS Низкий

Описание

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

Ссылки

https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4
Product
https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1
Product
https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj
Vendor Advisory
https://www.openwall.com/lists/oss-security/2026/04/10/14
Mailing List

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:flatpak:xdg-desktop-portal:*:*:*:*:*:*:*:*

Версия до 1.20.4 (исключая)

cpe:2.3:a:flatpak:xdg-desktop-portal:1.21.0:*:*:*:*:*:*:*

EPSS

Процентиль: 3%

0.00128

Низкий

2.9 Low

CVSS3

6.3 Medium

CVSS3

Дефекты

CWE-61

Связанные уязвимости

CVE-2026-40354

CVSS3: 2.9

ubuntu

4 месяца назад

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

CVE-2026-40354

CVSS3: 6.1

redhat

4 месяца назад

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

CVE-2026-40354

CVSS3: 2.9

debian

4 месяца назад

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allo ...

SUSE-SU-2026:2712-1

suse-cvrf

около 1 месяца назад

Security update for xdg-desktop-portal

GHSA-v5fw-rcv7-v6f3

CVSS3: 2.9

github

4 месяца назад

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

EPSS

Процентиль: 3%

0.00128

Низкий

2.9 Low

CVSS3

6.3 Medium

CVSS3

Дефекты

CWE-61