CVE-2026-34078

OVERVIEW CVE-2026-34078 is a critical vulnerability in Flatpak versions prior to 1.16.4 that affects the Linux application sandboxing framework. The flaw exists in the sandbox-expose options, which improperly handle symlinks that can be controlled by applications. This allows malicious applications to traverse sandbox boundaries by pointing symlinks at arbitrary host paths, effectively bypassing the intended isolation mechanism. SEVERITY The vulnerability has a FAUCET Risk Score of 53.0/100, indicating moderate-to-significant concern. The attack vector is local and requires minimal complexity, as it only requires an application to craft a symlink within its controlled environment. The impact is severe, as successful exploitation grants full access to arbitrary host files and can serve as a primitive for achieving code execution at the host system level, completely undermining Flatpak's security model. No CVSS score has been assigned, though the EPSS score of 0.00043 suggests current exploitation likelihood is very low. EXPLOITATION STATUS There is no indication of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on relevant monitoring lists. No public exploit code appears to be widely available. Community attention appears limited, likely due to the low current exploitation rate and the straightforward remediation path through updating to version 1.16.4.