All vulnerabilities
CVE-2026-55888GHSA-cm83-2936-gxjm

xdg-desktop-portal: XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal

flatpak xdg-desktop-portal
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed in1.22.1Fixed versionGitHub
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1.22.1xdg-desktop-portalGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.

Text from CVE List

Affected versions 2

  • xdg-desktop-portalaffected: < 1.22.1CVE List
  • xdg-desktop-portal<=1.22.0GitHub

References 2