CVE-2026-34078: Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/flatpakto a version that resolves this vulnerability.Fixed in 1.14.10-1~deb12u2Fixed in 1.16.6-1~deb13u2Fixed in 1.18.2-1 - Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.16.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34078?
CVE-2026-34078 has a high severity rating due to its potential for sandbox escape and code execution on the host.
How do I fix CVE-2026-34078?
To fix CVE-2026-34078, upgrade Flatpak to version 1.16.4 or later.
What products are affected by CVE-2026-34078?
CVE-2026-34078 affects Flatpak versions prior to 1.16.4.
What kind of attack vector is associated with CVE-2026-34078?
CVE-2026-34078 allows attackers to exploit app-controlled symlinks to escape the Flatpak sandbox.
Is CVE-2026-34078 a critical vulnerability?
Yes, CVE-2026-34078 is considered critical due to the risks it poses to host file access and execution of arbitrary code.