Skip to content
Critical Flatpak Vulnerabilities Allow Host File Access and Deletion

Critical Flatpak Vulnerabilities Allow Host File Access and Deletion

First seen 10 Sep 2026, 15:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 11, 2026 at 15:18 UTC
  • •Flatpak vulnerabilities allow file access and deletion on host systems.
  • •CVE-2026-34078 and CVE-2026-34079 affect Ubuntu 20.04, 22.04, and 24.04 LTS.
  • •Users must update their systems to mitigate these critical vulnerabilities.

Two critical vulnerabilities in Flatpak, identified as CVE-2026-34078 and CVE-2026-34079, were discovered, allowing malicious applications to access files outside their sandbox or delete arbitrary files on the host system. These vulnerabilities stem from improper path validation in sandbox-expose options and when removing outdated ld.so cache files. Affected systems include Ubuntu 20.04 LTS, 22.04 LTS, and 24.04 LTS. The issues were published on April 7, 2026, and have been addressed through system updates. Users are advised to update their systems to mitigate these risks. The vulnerabilities pose a significant threat as they could lead to unauthorized access and potential code execution on the host. Overall, standard system updates will correct these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 64d ago How this analysis works

Timeline

2026-04-07
CVE-2026-34078 and CVE-2026-34079 published
Two vulnerabilities in Flatpak were disclosed, allowing unauthorized file access and deletion on host systems.
Ubuntu
2026-09-10
Vulnerabilities addressed in updates
Ubuntu released updates to address the Flatpak vulnerabilities, urging users to apply them to secure their systems.
Linuxsecurity

More articles in this cluster (2)

Following this threat?

Track Ubuntu and CVE-2026-34078 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3