Is CVE-2026-34079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34079 being exploited in the wild.

How severe is CVE-2026-34079?

High severity, with a CVSS score of 7.5, published 7 April 2026.

Is there a fix for CVE-2026-34079?

A patch was published on 2026-04-07: Fixed in version 1.16.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34079 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-34079?

Check whether you run Flatpak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34079: Flatpak arbitrary file deletion via ld.so cache path traversal

CVE-2026-34079 · Severity: high · CVSS 7.5 · Published 2026-04-07

Flatpak is a system used on Linux to run applications in a secure, isolated environment (a sandbox). A flaw in how it manages temporary library files allows a malicious application to bypass these security boundaries and delete any file on the user's computer. This could lead to data loss or system instability if critical system files are removed.

Technologies: Flatpak. Vendors: Flatpak.

Quick answers

Is CVE-2026-34079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34079 being exploited in the wild.
How severe is CVE-2026-34079?: High severity, with a CVSS score of 7.5, published 7 April 2026.
Which products and versions are affected?: Flatpak < 1.16.4.
Is there a fix for CVE-2026-34079?: A patch was published on 2026-04-07: Fixed in version 1.16.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34079 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-34079?: Check whether you run Flatpak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Flatpak's ld.so caching mechanism. The software fails to properly validate that application-controlled paths for outdated cache files reside within the designated cache directory before deletion. An attacker-controlled Flatpak application can exploit this lack of validation to issue deletion commands for arbitrary files on the host filesystem, effectively escaping the sandbox. The vulnerability is present in versions prior to 1.16.4 and is resolved in version 1.16.4 and later.

Affected products

Flatpak Flatpak < 1.16.4

Timeline

2026-04-07: disclosed
2026-04-07: advisory
2026-04-07: patched: Fixed in version 1.16.4

References

https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.