Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | xdg-desktop-portal | 0:1.0.2-1.amzn2.0.3 |
| Amazon Linux · 2 | xdg-desktop-portal-debuginfo | 0:1.0.2-1.amzn2.0.3 |
| Amazon Linux · 2 | xdg-desktop-portal-devel | 0:1.0.2-1.amzn2.0.3 |
Vulnerabilities 1
-
Low 2.9
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-40354.html