GHSA-p29x-r292-46pp: Flatpak affected by arbitrary file deletion on the host filesystem

Q: Which Flatpak versions are affected?

Flatpak versions prior to 1.16.4 are affected. The issue is fixed in Flatpak 1.16.4.

Q: What access does an attacker need to exploit this?

An attacker needs the ability to run a Flatpak application. No host-side privileges or user interaction are required according to the supplied severity vector.

Q: What is the practical impact on the host?

A malicious Flatpak app can cause arbitrary file deletion on the host filesystem through unsafe removal of outdated ld.so cache files. The supplied impact vector indicates availability impact, not confidentiality or integrity impact.

Published Apr 7, 2026

Updated

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.

Affected Software

1 affected component

Flatpak Flatpak<1.16.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Flatpak to a version that resolves this vulnerability.
Fixed in 1.16.4

Event History

Apr 7, 2026

CVE Published

via OSV·09:29 PM

Data Sourced

via OSV·09:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Flatpak versions are affected?

Flatpak versions prior to 1.16.4 are affected. The issue is fixed in Flatpak 1.16.4.

What access does an attacker need to exploit this?

An attacker needs the ability to run a Flatpak application. No host-side privileges or user interaction are required according to the supplied severity vector.

What is the practical impact on the host?

A malicious Flatpak app can cause arbitrary file deletion on the host filesystem through unsafe removal of outdated ld.so cache files. The supplied impact vector indicates availability impact, not confidentiality or integrity impact.

GHSA-p29x-r292-46pp: Flatpak affected by arbitrary file deletion on the host filesystem

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Flatpak versions are affected?

What access does an attacker need to exploit this?

What is the practical impact on the host?

Company

Resources

Contact

Frequently Asked Questions

Which Flatpak versions are affected?

What access does an attacker need to exploit this?

What is the practical impact on the host?