CVE-2026-55888: XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal

Q: Who is exposed to this issue?

Systems running XDG Desktop Portal versions before 1.22.1 are exposed when a malicious sandboxed application can invoke the FileChooser.SaveFiles method. Access is limited to host files that the user running the application is permitted to access.

Q: What does an attacker need to exploit it?

The attacker needs a malicious sandboxed application and user interaction with the SaveFiles file chooser flow. The application can supply crafted optional filenames that backends append to the directory selected by the user.

Q: Are default backend checks sufficient mitigation?

No. The frontend does not validate the supplied filenames, and common backends also do not validate them. Although backends are intended to ensure a target file does not already exist, the unvalidated filename handling permits path traversal to non-existing host files.

Q: How can this be remediated?

Upgrade XDG Desktop Portal to version 1.22.1, which contains the patch.

Published Oct 23, 2026

Updated

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.

Affected Software

1 affected component

freedesktop.org XDG Desktop Portal<1.22.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade XDG Desktop Portal to a version that resolves this vulnerability.
Fixed in 1.22.1

Event History

Oct 23, 2026

CVE Published

via MITRE·12:35 PM

Data Sourced

via MITRE·12:35 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems running XDG Desktop Portal versions before 1.22.1 are exposed when a malicious sandboxed application can invoke the FileChooser.SaveFiles method. Access is limited to host files that the user running the application is permitted to access.

What does an attacker need to exploit it?

The attacker needs a malicious sandboxed application and user interaction with the SaveFiles file chooser flow. The application can supply crafted optional filenames that backends append to the directory selected by the user.

Are default backend checks sufficient mitigation?

No. The frontend does not validate the supplied filenames, and common backends also do not validate them. Although backends are intended to ensure a target file does not already exist, the unvalidated filename handling permits path traversal to non-existing host files.

How can this be remediated?

Upgrade XDG Desktop Portal to version 1.22.1, which contains the patch.

CVE-2026-55888: XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default backend checks sufficient mitigation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default backend checks sufficient mitigation?

How can this be remediated?