UbuntuUpdates.org

Package "xdg-desktop-portal"

Name: xdg-desktop-portal

Description:

desktop integration portal for Flatpak and Snap
Latest version: 1.21.1+ds-1ubuntu3.1
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://flatpak.github.io/xdg-desktop-portal/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "xdg-desktop-portal"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "xdg-desktop-portal" in Resolute

Repository Area Version
base main 1.21.1+ds-1ubuntu3
base universe 1.21.1+ds-1ubuntu3
security universe 1.21.1+ds-1ubuntu3.1

Changelog

Version: 1.21.1+ds-1ubuntu3.1 2026-09-23 21:07:33 UTC

xdg-desktop-portal (1.21.1+ds-1ubuntu3.1) resolute-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-40354 (#2166546)
    - debian/patches/CVE-2026-40354-post1.patch: Get the fd of the file to
      trash on the host in src/trash.c
    - debian/patches/CVE-2026-40354-post2.patch: Check that the caller has
      write access on the fd to trash in src/trash.c
    - debian/patches/CVE-2026-40354-post3.patch: Never ignore the home trash
      location in src/trash.c
    - debian/patches/CVE-2026-40354-post4.patch: Add more debug logging in
      src/trash.c
    - debian/patches/CVE-2026-40354-post5.patch: Allow trash directories to
      have any mode in src/trash.c

 -- Kyle Kernick Tue, 22 Sep 2026 16:20:39 -0600
CVE-2026-40354 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack o


About   -   Send Feedback to @ubuntu_updates