PT-2026-32056 · Unknown+2 · Xdg-Desktop-Portal+2

Publicado 2026-04-11 · Atualizado 2026-05-20 · CVE-2026-40354

Positive Technologies (AI Summary) · Pt

CVSS v3.1

6.3

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions xdg-desktop-portal versões anteriores a 1.20.4 xdg-desktop-portal versões anteriores a 1.21.1

Description O Flatpak xdg-desktop-portal permite que qualquer aplicativo Flatpak mova qualquer arquivo no contexto do host para a lixeira. Isso é possível por meio de um ataque de link simbólico (symlink) direcionado à função g file trash().

Recommendations Atualize para a versão 1.20.4 ou posterior. Atualize para a versão 1.21.1 ou posterior.

Correção

Enumeração de Fraquezas

CWE-61

Identificadores relacionados

CVE-2026-40354

OESA-2026-2182

OESA-2026-2183

OESA-2026-2184

USN-8287-1

Produtos afetados

Linuxmint

Ubuntu

Xdg-Desktop-Portal

Referências · 20

• https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1 · Nota
• https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4 · Nota
• https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2026-2183 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2026-2184 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-40354 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-8287-1 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2183 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2182 · Nota
• https://cve.org/CVERecord?id=CVE-2026-40354 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40354 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-40354 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2026-2182 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2184 · Nota
• https://twitter.com/CVEnew/status/2045972428699193825 · Publicação no Twitter