File Access Vulnerability in XDG Desktop Portal by Flatpak

CVE-2026-55888

What is CVE-2026-55888?

The XDG Desktop Portal is designed to facilitate integration between desktop environments and applications. Before version 1.22.1, it contained a vulnerability within the FileChooser.SaveFiles method. This vulnerability allowed malicious sandboxed applications to exploit filename handling procedures. Specifically, the method's capability to accept optional filenames was improperly managed, permitting access to non-existing files within the user's home directory. The backend systems, expected to validate filenames, failed to do so adequately, leaving users susceptible to unauthorized file access. This issue has been addressed in version 1.22.1.

References