Bug 2565122

Summary: CVE-2026-55888 xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames [fedora-43]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: xdg-desktop-portalAssignee: David King <amigadave>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: 43CC: amigadave, debarshir, gnome-sig, jadahl
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["667207c5-0f41-4041-89f0-dc980fcd855a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2559766    

Description Vladimir Vasilev 2026-11-02 11:36:35 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.