Flatpak xdg-desktop-portal versions before 1.20.4 and 1.21.1 contain a symlink following vulnerability (CWE-61) that enables any Flatpak app to trash arbitrary files on the host system by leveraging a symlink attack on the g_file_trash function. This vulnerability arises from insufficient validation or handling of symbolic links within the file trashing process, potentially allowing unauthorized file deletion. The CVSS 3.1 base score is 2.9, reflecting low severity due to the attack vector requiring local access with high complexity and no privileges. There is no vendor advisory or patch information provided, and no known exploits have been observed.

An attacker with the ability to run a Flatpak application can exploit this vulnerability to delete files on the host system by tricking the system into trashing files via symbolic links. The impact is limited to file availability (low integrity impact) and does not affect confidentiality or system availability beyond file deletion. The low CVSS score reflects the limited scope and difficulty of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the installation and execution of untrusted Flatpak applications to reduce risk. Monitor Flatpak and xdg-desktop-portal updates for patches addressing this vulnerability.