CVE-2026-34078
Received Received - Intake
Symlink Resolution Flaw in Flatpak Allows Host Code Execution

Publication date: 2026-04-07

Last updated on: 2026-04-24

Assigner: GitHub, Inc.

Description
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-07
Last Modified
2026-04-24
Generated
2026-06-16
AI Q&A
2026-04-08
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34078
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
flatpak flatpak to 1.16.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Flatpak, a Linux application sandboxing and distribution framework. Before version 1.16.4, Flatpak's portal accepted paths in the sandbox-expose options that could be controlled by the application as symbolic links pointing to arbitrary paths on the host system. When Flatpak runs, it mounts the resolved host path inside the sandbox, effectively giving the application access to all files on the host. This flaw can be exploited as a primitive to gain code execution in the host context.

Impact Analysis

The vulnerability allows an application running inside the Flatpak sandbox to access any file on the host system by exploiting app-controlled symbolic links. This can lead to unauthorized access to sensitive files and potentially allow the attacker to execute code with the privileges of the host environment, compromising the security and integrity of the host system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Flatpak to version 1.16.4 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34078. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart