Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 25.10 Advisory USN-8287-1 XDG Desktop Portal Important Deletion Risk

ubuntu
Calendar Grey May 21, 2026
Dist Ubuntu Esm H88
XDG Desktop Portal flaw allows local attackers to delete files via symlink attacks in Ubuntu. Critical updates are advised.
XDG Desktop Portal could be made to delete files.

Summary

XDG Desktop Portal could be made to delete files.

Software Description:

- xdg-desktop-portal: A portal frontend service for Flatpak and other desktop containment frameworks

Details:

It was discovered that XDG Desktop Portal incorrectly handled

trashing files. A local attacker could possibly use this issue to

delete arbitrary files on the host file system via a symlink attack.

Topics%20covered

Topics Covered

security advisory Ubuntu important local attack file deletion xdg-desktop-portal

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  xdg-desktop-portal              1.20.3+ds-1ubuntu1.1
  xdg-desktop-portal-dev          1.20.3+ds-1ubuntu1.1

Ubuntu 24.04 LTS
  xdg-desktop-portal              1.18.4-1ubuntu2.24.04.2
  xdg-desktop-portal-dev          1.18.4-1ubuntu2.24.04.2

In general, a standard system update will make all the necessary
changes.

References

https://ubuntu.com/security/notices/USN-8287-1

CVE-2026-40354

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-8287-1

Topics%20covered

Topics Covered

security advisory Ubuntu important local attack file deletion xdg-desktop-portal

Package Information

https://launchpad.net/ubuntu/+source/xdg-desktop-portal/1.20.3+ds-1ubuntu1.1
https://launchpad.net/ubuntu/+source/xdg-desktop-portal/1.18.4-1ubuntu2.24.04.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here