Nixpkgs security tracker

Untriaged

Permalink CVE-2026-40354

2.9 LOW

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): HIGH
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): LOW

created 3 days, 20 hours ago

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any …

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

References

Affected products

xdg-desktop-portal

<1.20.4
<1.21.1

Matching in nixpkgs

pkgs.xdg-desktop-portal

Desktop integration portals for sandboxed apps

nixos-unstable 1.20.4
- nixpkgs-unstable 1.20.4
- nixos-unstable-small 1.20.4
nixos-25.11 1.20.4
- nixos-25.11-small 1.20.4
- nixpkgs-25.11-darwin 1.20.4

pkgs.xdg-desktop-portal-gtk

Desktop integration portals for sandboxed apps

nixos-unstable 1.15.3
- nixpkgs-unstable 1.15.3
- nixos-unstable-small 1.15.3
nixos-25.11 1.15.3
- nixos-25.11-small 1.15.3
- nixpkgs-25.11-darwin 1.15.3

pkgs.xdg-desktop-portal-wlr

xdg-desktop-portal backend for wlroots

nixos-unstable 0.8.1
- nixpkgs-unstable 0.8.1
- nixos-unstable-small 0.8.1
nixos-25.11 0.8.0
- nixos-25.11-small 0.8.0
- nixpkgs-25.11-darwin 0.8.0

pkgs.xdg-desktop-portal-xapp

Backend implementation for xdg-desktop-portal for Cinnamon, MATE, Xfce

nixos-unstable 1.1.3
- nixpkgs-unstable 1.1.3
- nixos-unstable-small 1.1.3
nixos-25.11 1.1.3
- nixos-25.11-small 1.1.3
- nixpkgs-25.11-darwin 1.1.3

pkgs.xdg-desktop-portal-gnome

Backend implementation for xdg-desktop-portal for the GNOME desktop environment

nixos-unstable 49.0
- nixpkgs-unstable 49.0
- nixos-unstable-small 49.0
nixos-25.11 49.0
- nixos-25.11-small 49.0
- nixpkgs-25.11-darwin 49.0

pkgs.xdg-desktop-portal-phosh

A backend implementation for xdg-desktop-portal that is using GTK/GNOME/Phosh to provide interfaces that aren't provided by the GTK portal

nixos-unstable 0.49.0
- nixpkgs-unstable 0.49.0
- nixos-unstable-small 0.49.0
nixos-25.11 0.49.0
- nixos-25.11-small 0.49.0
- nixpkgs-25.11-darwin 0.49.0

pkgs.xdg-desktop-portal-shana

Filechooser portal backend for any desktop environment

nixos-unstable 0.3.16
- nixpkgs-unstable 0.3.16
- nixos-unstable-small 0.3.16
nixos-25.11 0.3.16
- nixos-25.11-small 0.3.16
- nixpkgs-25.11-darwin 0.3.16

pkgs.xdg-desktop-portal-cosmic

XDG Desktop Portal for the COSMIC Desktop Environment

nixos-unstable 1.0.8
- nixpkgs-unstable 1.0.8
- nixos-unstable-small 1.0.8
nixos-25.11 1.0.0
- nixos-25.11-small 1.0.0
- nixpkgs-25.11-darwin 1.0.0

pkgs.xdg-desktop-portal-hyprland

xdg-desktop-portal backend for Hyprland

nixos-unstable 1.3.11
- nixpkgs-unstable 1.3.11
- nixos-unstable-small 1.3.11
nixos-25.11 1.3.11
- nixos-25.11-small 1.3.11
- nixpkgs-25.11-darwin 1.3.11

pkgs.xdg-desktop-portal-luminous

xdg-desktop-portal backend for wlroots based compositors, providing screenshot and screencast

nixos-unstable 0.1.14
- nixpkgs-unstable 0.1.14
- nixos-unstable-small 0.1.14
nixos-25.11 0.1.11
- nixos-25.11-small 0.1.11
- nixpkgs-25.11-darwin 0.1.11

pkgs.lxqt.xdg-desktop-portal-lxqt

Backend implementation for xdg-desktop-portal that is using Qt/KF5/libfm-qt

nixos-unstable 1.3.0
- nixpkgs-unstable 1.3.0
- nixos-unstable-small 1.3.0
nixos-25.11 1.3.0
- nixos-25.11-small 1.3.0
- nixpkgs-25.11-darwin 1.3.0

pkgs.kdePackages.xdg-desktop-portal-kde

A backend implementation for xdg-desktop-portal that is using Qt/KDE

nixos-unstable 6.6.4
- nixpkgs-unstable 6.6.4
- nixos-unstable-small 6.6.4
nixos-25.11 6.5.6
- nixos-25.11-small 6.5.6
- nixpkgs-25.11-darwin 6.5.6

pkgs.xdg-desktop-portal-termfilechooser

xdg-desktop-portal backend for choosing files with your favorite file chooser

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-25.11 1.2.1
- nixos-25.11-small 1.2.1
- nixpkgs-25.11-darwin 1.2.1

pkgs.pantheon.xdg-desktop-portal-pantheon

Backend implementation for xdg-desktop-portal for the Pantheon desktop environment

nixos-unstable 8.1.0
- nixpkgs-unstable 8.1.0
- nixos-unstable-small 8.1.0
nixos-25.11 8.0.4
- nixos-25.11-small 8.0.4
- nixpkgs-25.11-darwin 8.0.4

Package maintainers

@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
@mjm Matt Moriarity <matt@mattmoriarity.com>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@bkchr Bastian Köcher <nixos@kchr.de>
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
@FRidh Frederik Rietdijk <fridh@fridh.nl>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@ttuegel Thomas Tuegel <ttuegel@mailbox.org>
@K900 Ilya K. <me@0upti.me>
@NickCao Nick Cao <nickcao@nichi.co>
@romildo José Romildo Malaquias <malaquias@gmail.com>
@davidak David Kleuker <post@davidak.de>
@bobby285271 Bobby Rong <rjl931189261@126.com>
@jtojnar Jan Tojnar <jtojnar@gmail.com>
@HeitorAugustoLN Heitor Augusto <nixpkgs.woven713@passmail.net>
@nyabinary Niko Cantero <nyanbinary@keemail.me>
@Pandapip1 Gavin John <gavinnjohn@gmail.com>
@thefossguy Pratham Patel <prathampatel@thefossguy.com>
@drakon64 Evelyn Chance <nixpkgs@drakon.cloud>
@michaelBelsanti Mike Belsanti <mbels03@protonmail.com>
@ahoneybun Aaron Honeycutt <aaronhoneycutt@proton.me>
@alyssais Alyssa Ross <hi@alyssa.is>
@a-kenji Alexander Kenji Berthold <aks.kenji@protonmail.com>
@hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
@dasj19 Daniel Șerbănescu <daniel@serbanescu.dk>
@khaneliman Austin Horstman <khaneliman12@gmail.com>
@NotAShelf NotAShelf <raf@notashelf.dev>
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
@donovanglover Donovan Glover
@fufexan Fufezan Mihai <fufexan@protonmail.com>
@Rishik-Y Rishik Yalamanchili <202301258@daiict.ac.in>
@ArmelClo Armel Cloarec <armel@armelclo.fr>
@SamueleFacenda Samuele Facenda <samuele.facenda@gmail.com>
@Gliczy Gliczy
@L-Trump Luo Chen <ltrump@163.com>
@body20002 Abdallah Gamal <body20002.test@gmail.com>
@minijackson Rémi Nicole <minijackson@riseup.net>
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>

Suggestions search