PT-2026-31025 · Flatpak · Flatpak

Published 2026-04-07 · Updated 2026-04-10 · CVE-2026-34079

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.16.4

Description Flatpak, a Linux application sandboxing and distribution framework, contained a flaw where the caching mechanism for ld.so did not adequately verify that an application-controlled path to an outdated cache resided within the cache directory. This allowed Flatpak applications to delete arbitrary files on the host system.

Recommendations Update to Flatpak version 1.16.4 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-34079

Affected Products

Flatpak

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34079 · Security Note
• https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp · Note
• https://twitter.com/oss_security/status/2042427590137303446 · Twitter Post
• https://twitter.com/CVEnew/status/2041711864258949585 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041706609563304081 · Twitter Post
• https://twitter.com/syedaquib77/status/2041835524772565199 · Twitter Post