---
id: CVE-2026-55888
title: >-
  XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path
  traversal
summary: >-
  XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1,
  malicious sandboxed applications can use the FileChooser.SaveFiles method to
  gain arbitrary file access to non-existing files on the host (limited to files
  the …
severity: high
cvss: 8.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: flatpak
product: xdg-desktop-portal
affected:
  - xdg-desktop-portal < 1.22.1
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:35:23.077Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-55888'
references:
  - url: >-
      https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-cm83-2936-gxjm
    label: >-
      https://github.com/flatpak/xdg-desktop-portal/security/advisories/GHSA-cm83-2936-gxjm
  - url: 'https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1'
    label: 'https://github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.510Z'
---

## Overview

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.

## Affected

- `xdg-desktop-portal < 1.22.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.