Improper Cache Handling in Flatpak Leads to Unrestricted File Deletion

CVE-2026-34079

What is CVE-2026-34079?

A flaw in the Flatpak application sandboxing and distribution framework allows apps to delete arbitrary files on the host machine. This occurs due to the improper handling of outdated cache files by the caching mechanism in ld.so. Specifically, before version 1.16.4, the framework failed to check whether the app-controlled path to these outdated cache files was within the designated cache directory. This shortcoming exposes systems to potential data loss or unauthorized file manipulation, necessitating an update to the fixed version to ensure system integrity.

References