CVE-2026-34078

CRITICAL

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Title source: cna
STIX 2.1

Description

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

References (3)

Scores

CVSS v4 9.3
EPSS 0.0005
EPSS Percentile 15.5%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-61
Status published
Products (1)
flatpak/flatpak < 1.16.4
Published Apr 07, 2026
Tracked Since Apr 08, 2026