PT-2026-32056 · Unknown+2 · Xdg-Desktop-Portal+2

Published 2026-04-11 · Updated 2026-05-20 · CVE-2026-40354

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions xdg-desktop-portal versions prior to 1.20.4 xdg-desktop-portal versions prior to 1.21.1

Description Flatpak xdg-desktop-portal allows any Flatpak application to move any file in the host context to the trash. This is possible through a symlink attack targeting the g file trash() function.

Recommendations Update to version 1.20.4 or later. Update to version 1.21.1 or later.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-40354

OESA-2026-2182

OESA-2026-2183

OESA-2026-2184

USN-8287-1

Affected Products

Linuxmint

Ubuntu

Xdg-Desktop-Portal

References · 20

• https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-rqr9-jwwf-wxgj · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2183 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40354 · Security Note
• https://ubuntu.com/security/notices/USN-8287-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40354 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40354 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40354 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40354 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40354 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8287-1 · Vendor Advisory
• https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.21.1 · Note
• https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.20.4 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2183 · Note