Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | xdg-desktop-portal | 0:1.18.4-107.amzn2023 |
| Amazon Linux · 2023 | xdg-desktop-portal-debuginfo | 0:1.18.4-107.amzn2023 |
| Amazon Linux · 2023 | xdg-desktop-portal-debugsource | 0:1.18.4-107.amzn2023 |
| Amazon Linux · 2023 | xdg-desktop-portal-devel | 0:1.18.4-107.amzn2023 |
Vulnerabilities 1
-
Low 2.9
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-40354.html