CVE-2026-34079

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-34079 # Description: Simulates the logic flaw where a symlink outside the cache dir is deleted. # Note: Actual exploitation requires packaging within a Flatpak environment. import os def main(): # Simulate the target file on the host system target_file = "/tmp/important_host_file.log" # Create the target file with open(target_file, 'w') as f: f.write("Critical system configuration") print(f"[+] Created dummy host file: {target_file}") # Simulate the Flatpak cache directory cache_dir = "/var/tmp/flatpak_cache" os.makedirs(cache_dir, exist_ok=True) # The malicious app creates a stale cache entry pointing to the host file # In the vulnerability, the path validation is bypassed malicious_link = os.path.join(cache_dir, "stale-cache-entry") os.symlink(target_file, malicious_link) print(f"[+] Created symlink from cache to host file: {malicious_link} -> {target_file}") # Simulate the cleanup process (unlink) performed by Flatpak print("[*] Triggering Flatpak ld.so cache cleanup...") try: os.unlink(malicious_link) print(f"[-] Exploit successful: {target_file} has been deleted.") print("[!] This demonstrates the arbitrary file deletion vulnerability.") except FileNotFoundError: print("[!] File not found.") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-34079", "sourceIdentifier": "[email protected]", "published": "2026-04-07T22:16:22.080", "lastModified": "2026-04-17T20:26:32.860", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.16.4", "matchCriteriaId": "760D9FEB-859C-410E-9064-438FB399CFDD"}]}]}], "references": [{"url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}