Skip to content
COOEY

EXPOSURES › CVE-2026-34078

CVE-2026-34078

CRITICAL
DETAIL
SourceNVD · cve Published2026-04-07 CVSS10.0 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-34078 ↗
⚡ RCE ◐ ZERO-DAY SHAME 50/100 rcezero-day

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This g

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED
flatpak · vendorflatpak · product
DESCRIPTION

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.