CVE-2026-40354
LOW
NVD
CVSS Score
2.9
Severity
LOW
Published
Apr 11, 2026
Vendor
unknown
Description
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.