Is CVE-2026-40354 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40354 being exploited in the wild.

How severe is CVE-2026-40354?

Low severity, with a CVSS score of 2.9, published 11 April 2026.

Which products and versions are affected?

Flatpak xdg-desktop-portal < 1.20.4, 1.21.0.

Is there a fix for CVE-2026-40354?

A patch was published on 2026-04-08: Version 1.20.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40354 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-40354?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40354: Flatpak xdg-desktop-portal symlink attack in Trash portal

Q: Is there a fix for CVE-2026-40354?

A patch was published on 2026-04-08: Version 1.20.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40354 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-40354?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40354 · Severity: low · CVSS 2.9 · Published 2026-04-11

A vulnerability in the Flatpak desktop portal allows malicious or compromised applications to delete or move any file on the host computer to the trash. This bypasses the security sandbox intended to keep applications isolated from the rest of the system. An attacker could use this to disrupt system operations or delete critical user data.

Quick answers

Is CVE-2026-40354 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40354 being exploited in the wild.
How severe is CVE-2026-40354?: Low severity, with a CVSS score of 2.9, published 11 April 2026.
Which products and versions are affected?: Flatpak xdg-desktop-portal < 1.20.4, 1.21.0.
Is there a fix for CVE-2026-40354?: A patch was published on 2026-04-08: Version 1.20.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40354 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-40354?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the Trash portal of xdg-desktop-portal. The portal uses the g_file_trash function on paths that can traverse client-controlled directory trees. A malicious Flatpak application can request the portal to trash a file it owns and then quickly replace that file with a symbolic link pointing to a file on the host system. Because the portal does not safely handle the symlink redirection during the trashing process, it may move the host-level target of the symlink to the trash instead of the intended application file. This issue is resolved in versions 1.20.4 and 1.21.1.

Affected products

Flatpak xdg-desktop-portal < 1.20.4, 1.21.0

Timeline

2026-04-08: patched: Version 1.20.4 released
2026-04-08: advisory: GitHub Security Advisory GHSA-rqr9-jwwf-wxgj published
2026-04-10: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.