CVE-2026-34078CWE-61

Flatpak has a complete sandbox escape leading to host file access and code execution in the host context

Critical · published April 7, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00897 · 59.2th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-04-07T21:27Z
EPSS history
Timeline
  • 07 APR 21:27Z
    Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
    cvelistv5