Advisories · Technology

flatpak xdg-desktop-portal.

Every CVE that names flatpak xdg-desktop-portal among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-55888 CVE record

CVSS 8.8 High

XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
- flatpak xdg-desktop-portal
- Path traversal
Not analysed yet 23 Oct 2026
CVE-2026-55889 CVE record

CVSS 8.3 High

XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
- flatpak xdg-desktop-portal
- Weak cryptography or TLS
- CWE-337
Not analysed yet 23 Oct 2026
CVE-2026-40354 CVE record

CVSS 2.9 Low

Flatpak xdg-desktop-portal: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app…
- Flatpak xdg-desktop-portal
- CWE-61
Not analysed yet 11 Apr 2026