Flatpak 1.16.4 fixes sandbox escape and three other security flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-34078 +1 in the same advisory: …34079 | Flatpak is a Linux application sandboxing and distribution framework. Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4. NVD description · AI analysis pending | 9.3 group max | 2% |
| — |
Full article101 words · extracted from helpnetsecurity.com · click to collapse
Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities.
The most severe fix addresses a complete sandbox escape that leads to host file access and code execution in the host context, tracked as CVE-2026-34078.
File system exposure
Two additional fixes address file system exposure on the host. CVE-2026-34079 prevents arbitrary file deletion on the host filesystem. GHSA-2fxp-43j9-pwvc prevents arbitrary read-access to files in the system-helper context.
The fourth fix, tracked as GHSA-89xm-3m96-w3jg, prevents orphaning of cross-user pull operations.
The release is available on the Flatpak GitHub repository. Administrators running Flatpak should update to 1.16.4.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/04/08/flatpak-1-16-4-released-fixes-sandbox-escape/