146 matches found
CVE-2026-55888
A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate filenames before passing them to backend services...
CVE-2026-55889
A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator PRNG to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the internal state of the generator, a malicious sandboxed application...
CVE-2026-55888
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...
CVE-2026-55889
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
EUVD-2026-108752
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...
CVE-2026-55888
The xdg-desktop-portal desktop integration portal is vulnerable to arbitrary file access due to a path traversal flaw in the FileChooser.SaveFiles method (affecting versions prior to 1.22.1 ). Malicious sandboxed applications (e.g., via Flatpak or Snap ) can bypass validation in the frontend and ...
CVE-2026-55888 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...
CVE-2026-55888 XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...
CVE-2026-55889 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
EUVD-2026-108751
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
CVE-2026-55889
The xdg-desktop-portal desktop integration portal is vulnerable to data theft via predictable FileTransfer keys prior to version 1.22.1 . Malicious sandboxed applications can exploit the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data intended for other application...
CVE-2026-55889 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
CVE-2026-55889 XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...
Linux Distros Unpatched Vulnerability : CVE-2026-55889
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to...
Linux Distros Unpatched Vulnerability : CVE-2026-55888
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain...
Astra Linux – Vulnerability in Flatpak
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak application could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak...
[SECURITY] Fedora 45 Update: xdg-desktop-portal-gnome-51.0-1.fc45
A backend implementation for xdg-desktop-portal that is using various pieces of GNOME infrastructure, such as the org.gnome.Shell.Screenshot or org.gnome.SessionManager D-Bus interfaces...
USN-8287-2 xdg-desktop-portal regression
USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the fix for CVE-2026-40354 was incomplete and introduced a regression when trashing files. This update fixes the problem and provides the corresponding update for Ubuntu 26.04 LTS. We apologize for the inconvenience. Original...
USN-8287-2: XDG Desktop Portal regression
USN-8287-1 fixed a vulnerability in XDG Desktop Portal. Unfortunately the fix for CVE-2026-40354 was incomplete and introduced a regression when trashing files. This update fixes the problem and provides the corresponding update for Ubuntu 26.04 LTS. We apologize for the inconvenience. Original...
OESA-2026-2998 xdg-desktop-portal security update
xdg-desktop-portal works by exposing a series of D-Bus interfaces known as portals under a well-known name org.freedesktop.portal.Desktop and object path /org/freedesktop/portal/desktop. The portal interfaces include APIs for file access, opening URIs, printing and others. Security Fixes:...