CVE-2026-55888
XDG Desktop Portal is a desktop integration portal
- Risk score
- 66/100
- CVSS
- 8.8 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Prior to version 1.22.1 of XDG Desktop Portal, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host. An attacker could use this to gain unauthorized access to files.
- Affected
- {'products': ['XDG Desktop Portal'], 'packages': [], 'versions': ['< 1.22.1']}
- Fix
- Upgrade to version 1.22.1 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
Last activity 23 Oct 2026. Patch Forecast updates every hour.