CVE-2026-34079

OVERVIEW CVE-2026-34079 is a path traversal vulnerability in Flatpak versions prior to 1.16.4, a widely used Linux application sandboxing framework. The flaw exists in the ld.so caching mechanism, which fails to properly validate that outdated cache file paths are actually located within the designated cache directory before deletion. This insufficient validation allows malicious Flatpak applications to bypass sandbox restrictions and delete arbitrary files on the host system. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector, low complexity, and no privilege or user interaction requirements. While the confidentiality impact is none, the integrity impact is significant, enabling unauthorized file deletion across the host system. The threat is further underscored by the FAUCET risk score of 48.0/100, indicating a moderate-to-high risk profile within the vulnerability ecosystem. EXPLOITATION STATUS There is no evidence of active exploitation at this time. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and the Exploit Prediction Scoring System (EPSS) probability of 0.0014 suggests minimal real-world exploitation likelihood. However, the moderate risk score indicates the vulnerability warrants attention for remediation, particularly for organizations relying on Flatpak for application isolation.