xdg-desktop-portal - Debian Package Tracker

general

source: xdg-desktop-portal (main)
version: 1.22.1+ds-1
maintainer: Utopia Maintenance Team (archive) (DMD)
uploaders: Simon McVittie [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.8.1-1
oldstable: 1.16.0-2
stable: 1.20.3+ds-1
testing: 1.22.1+ds-1
unstable: 1.22.1+ds-1

versioned links

1.8.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.20.3+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.22.1+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

xdg-desktop-portal (5 bugs: 0, 3, 2, 0)
xdg-desktop-portal-dev
xdg-desktop-portal-tests

action needed

3 security issues in trixie high

There are 3 open security issues in trixie.

2 important issues:

CVE-2026-55888: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
CVE-2026-55889: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.

1 issue left for the package maintainer to handle:

CVE-2026-40354: (needs triaging) Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-04-08 Last update: 2026-10-24 12:19

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-55888: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames which get appended to the selected directory by backends. The backends are supposed to check that the file does not exist yet. The filenames are not validated by the frontend and also not by common backends. This issue has been patched in version 1.22.1.
CVE-2026-55889: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.

1 issue postponed or untriaged:

CVE-2026-40354: (needs triaging) Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.

Created: 2026-10-24 Last update: 2026-10-24 12:19

1 bug tagged help in the BTS normal

The BTS contains 1 bug tagged help, please consider helping the maintainer in dealing with it.

Created: 2019-07-09 Last update: 2026-10-27 15:00

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit a7e33839c73648601bdbc8e270705820df962680
Author: Alessandro Astone <alessandro.astone@canonical.com>
Date:   Wed Sep 16 16:37:47 2026 +0200

    d/rules, d/tests: Run the full testsuite
    
    Set XDP_TEST_RUN_LONG=1, otherwise the upstream testsuite by default only
    runs tests for host apps and flatpaks.
    
    Gbp-Dch: Full

commit f74d3a5122216a54c2b3c735b63dae55ca4fff40
Author: Simon McVittie <smcv@debian.org>
Date:   Thu Jun 18 14:42:45 2026 +0100

    Mark patch as forwarded

Created: 2026-06-18 Last update: 2026-10-20 22:03

news

[rss feed]

[2026-06-23] xdg-desktop-portal 1.22.1+ds-1 MIGRATED to testing (Debian testing watch)
[2026-06-18] Accepted xdg-desktop-portal 1.22.1+ds-1 (source) into unstable (Simon McVittie)
[2026-06-08] Accepted xdg-desktop-portal 1.22.0+ds-1 (source) into experimental (Simon McVittie)
[2026-04-13] Accepted xdg-desktop-portal 1.21.1+ds-1 (source) into experimental (Simon McVittie)
[2026-04-13] xdg-desktop-portal 1.20.4+ds-1 MIGRATED to testing (Debian testing watch)
[2026-04-08] Accepted xdg-desktop-portal 1.20.4+ds-1 (source) into unstable (Simon McVittie)
[2026-03-17] xdg-desktop-portal 1.20.3+ds-3 MIGRATED to testing (Debian testing watch)
[2026-03-12] Accepted xdg-desktop-portal 1.20.3+ds-3 (source) into unstable (Simon McVittie)
[2026-01-30] xdg-desktop-portal 1.20.3+ds-2 MIGRATED to testing (Debian testing watch)
[2026-01-24] Accepted xdg-desktop-portal 1.21.0+ds-1 (source) into experimental (Simon McVittie)
[2026-01-24] Accepted xdg-desktop-portal 1.20.3+ds-2 (source) into unstable (Simon McVittie)
[2025-05-29] xdg-desktop-portal 1.20.3+ds-1 MIGRATED to testing (Debian testing watch)
[2025-05-21] Accepted xdg-desktop-portal 1.20.3+ds-1 (source) into unstable (Simon McVittie)
[2025-05-17] Accepted xdg-desktop-portal 1.20.1+ds-2 (source) into unstable (Simon McVittie)
[2025-05-16] Accepted xdg-desktop-portal 1.20.1+ds-1 (source) into experimental (Simon McVittie)
[2025-03-28] xdg-desktop-portal 1.20.0+ds-2 MIGRATED to testing (Debian testing watch)
[2025-03-22] Accepted xdg-desktop-portal 1.20.0+ds-2 (source) into unstable (Simon McVittie)
[2025-02-25] xdg-desktop-portal 1.20.0+ds-1 MIGRATED to testing (Debian testing watch)
[2025-02-20] Accepted xdg-desktop-portal 1.20.0+ds-1 (source) into unstable (Simon McVittie)
[2025-02-17] Accepted xdg-desktop-portal 1.19.4+ds-1 (source) into unstable (Simon McVittie)
[2025-02-14] Accepted xdg-desktop-portal 1.19.3+ds-1 (source) into unstable (Simon McVittie)
[2025-01-21] Accepted xdg-desktop-portal 1.19.2+ds-1 (source) into experimental (Simon McVittie)
[2025-01-07] xdg-desktop-portal 1.18.4-2 MIGRATED to testing (Debian testing watch)
[2025-01-02] Accepted xdg-desktop-portal 1.19.1+ds-1 (source) into experimental (Simon McVittie)
[2025-01-01] Accepted xdg-desktop-portal 1.18.4-2 (source) into unstable (Simon McVittie)
[2024-10-31] Accepted xdg-desktop-portal 1.19.0+ds-1 (source) into experimental (Simon McVittie)
[2024-05-03] xdg-desktop-portal 1.18.4-1 MIGRATED to testing (Debian testing watch)
[2024-04-18] Accepted xdg-desktop-portal 1.18.4-1 (source) into unstable (Simon McVittie)
[2024-04-04] Accepted xdg-desktop-portal 1.18.3-1 (source) into unstable (Jeremy Bícha) (signed by: Jeremy Bicha)
[2023-12-03] xdg-desktop-portal 1.18.2-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 7
RC: 0
I&N: 5
M&W: 2
F&P: 0
patch: 0
help: 1

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 48)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.21.1+ds-1ubuntu6
43 bugs (1 patch)
patches for 1.21.1+ds-1ubuntu6