A vulnerability, which was classified as critical, was found in Flatpak xdg-desktop-portal up to 1.20.3/1.21.0. Affected is the function
g_file_trash. Such manipulation leads to symlink following.
This vulnerability is referenced as CVE-2026-40354. The attack can only be performed from a local environment. No exploit is available.
You should upgrade the affected component.
