Back Feeds2.Feedburner

Flatpak 1.16.4 fixes sandbox escape and three other security flaws

Feeds2.Feedburner •Anamarija Pogorelec • April 8, 2026

Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078. File system exposure Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2fxp-43j9-pwvc prevents arbitrary read-access to files in the system-helper context. The fourth fix, … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Flatpak 1.16.4 Addresses Critical Security Flaws Including Sandbox Escape Flatpak released version 1.16.4 on April 8, 2026, fixing four security vulnerabilities. The most critical issue, CVE-2026-34078, allows a complete sandbox escape, enabling unauthorized host file access and code execution. Two additional vulnerabilities, CVE-2026-34079 and GHSA-2fxp-43j9-pwvc, address file system exposure, preventing arbitrary file deletion and read-access on the host filesystem. These vulnerabilities affect users of the Flatpak framework, which is widely used for Linux application distribution. The fixes are now available, and users are urged to update their systems to mitigate these risks. The vulnerabilities were published on April 7, 2026, indicating a prompt response from the Flatpak team. The potential impact of these vulnerabilities is significant, given the critical nature of the sandbox escape. Current status is that the vulnerabilities have been patched, but users must take action to secure their systems. 4 sources 71

Extracted Entities

CVEs (2)

CVE-2026-34078 CVE-2026-34079

Platforms (1)

Linux