A flaw in the Flatpak xdg-desktop-portal component permits any Flatpak application to invoke the g_file_trash API with a crafted symbolic link, causing the host's file associated with the link to be removed. The vulnerability is a directory traversal / symlink manipulation issue (CWE‑59) leading to unintended file deletion. As a result, the attacker can delete arbitrary files on the host system, compromising data integrity and availability.

This flaw affects the Flatpak xdg‑desktop‑portal component in versions prior to 1.20.4 and any 1.21.x release older than 1.21.1. Users running one of these older releases on Linux distributions that provide Flatpak support are susceptible.

The CVSS score of 2.9 indicates a low‑severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local and requires the attacker to run a Flatpak application that uses the g_file_trash function. It is inferred that no elevated privileges are required; a regular user can create a symlink to a privileged file and trigger its deletion. Although the risk is modest, deleting critical system files could be disruptive.