Name: CVE-2026-34079: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2026-04-07T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-34079, CWE-22, CVSS 7.5, EPSS 0.00133

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.

CVSS Details

CVSS 4.0 Base Score: 8.7 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade flatpakUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-libs	May 31, 2026	May 28, 2026
Alpine Linux	—	Upgrade flatpak	Apr 9, 2026	Apr 7, 2026
Amazon_linux_2023	—	Upgrade flatpak-debugsourceUpgrade flatpakUpgrade flatpak-libs-debuginfoUpgrade flatpak-testsUpgrade flatpak-tests-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-libs	May 4, 2026	Apr 7, 2026
Debian	—	Upgrade flatpak	Apr 23, 2026	Apr 23, 2026
Gentoo Linux	—	Upgrade sys-apps/flatpak.	Aug 16, 2026	Aug 14, 2026
Oracle_linux	—	Upgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-builderUpgrade flatpak	Jun 1, 2026	Apr 7, 2026
Redhat_linux	—	Upgrade flatpakUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libsUpgrade flatpak-builderUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-debugsourceUpgrade flatpak-libs-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helper	Jun 3, 2026	Apr 7, 2026
Rocky_linux	—	Upgrade flatpak-debugsourceUpgrade flatpak-libs-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debuginfoUpgrade flatpakUpgrade flatpak-devel	Jun 1, 2026	May 29, 2026
Ubuntu	—	Upgrade flatpak (Ubuntu Pro)Upgrade libflatpak0 (Ubuntu Pro)	Sep 14, 2026	Sep 10, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence