xdg-desktop-portal Releases 1.22.0 and 1.22.1 Address Bug Fixes and Security Vulnerabilities

What is xdg-desktop-portal?

xdg-desktop-portal is a D-Bus service designed to facilitate secure interactions between sandboxed applications and the desktop environment. It is commonly used alongside application sandboxing technologies such as Flatpak and Snap to provide controlled access to resources like files, drag-and-drop, copy-paste, and launching applications. By exposing a set of standardized portals, it helps maintain security boundaries while allowing sandboxed apps to perform necessary desktop operations safely.

The project is widely used in Linux desktop environments, particularly in systems leveraging Flatpak for application distribution. It supports multiple desktop environments by abstracting the underlying platform-specific details and providing a consistent API.

Release 1.22.0 Highlights

Published on June 8, 2026, xdg-desktop-portal 1.22.0 focuses primarily on bug fixes to improve portal reliability and functionality:

• Dynamic Launcher Portal Icon Handling: Fixed the passing of icon GVariant data in the Dynamic Launcher Portal, ensuring that application icons are correctly handled and displayed (#2006).
• Document Portal Path Resolution: Improved the resolution of document paths in the Document Portal, specifically for the File Chooser and OpenURI portals, enhancing file access reliability (#2004).

These fixes contribute to smoother user experiences when sandboxed applications request file access or launch dynamic content.

Security-Focused Release 1.22.1

Shortly after, on June 17, 2026, version 1.22.1 was released addressing several critical security issues:

• Drag-and-Drop and Copy-Paste Data Redirection Vulnerability: Fixed a security flaw that allowed malicious sandboxed applications to redirect drag-and-drop and copy-paste data to themselves by exploiting a predictable key in the FileTransfer.RetrieveFiles portal (GHSA-c5cf-79w8-pvfh).
• Arbitrary Write Access Outside Sandbox: Resolved an issue where malicious sandboxed applications could gain arbitrary write access to nonexistent files outside their sandbox through the "files" option in the FileChooser.SaveFiles portal (GHSA-cm83-2936-gxjm).
• App ID Validation in Document Portal: Added validation of all application IDs in the Document Portal to prevent malicious applications from providing crafted App IDs that could trigger parsing of arbitrary host files as Glib.KeyFiles (#2023).
• PipeWire Realtime Module Disabled: Disabled PipeWire's realtime module to prevent potential deadlocks (#2012).

These security fixes are important for maintaining the integrity of the sandboxing model and preventing privilege escalation or unauthorized data access by sandboxed applications.

Community and Usage Context

xdg-desktop-portal plays a crucial role in Linux desktop sandboxing ecosystems, particularly with Flatpak and Snap. It ensures that sandboxed applications can safely interact with the desktop environment without compromising system security. Users and developers have noted occasional integration challenges, such as session target activation in certain desktop environments like XFCE, but the portal remains a key component for secure desktop application sandboxing.

Conclusion

The recent releases 1.22.0 and 1.22.1 of xdg-desktop-portal address both functional and security aspects of the project. While 1.22.0 improves portal reliability with bug fixes, 1.22.1 responds to critical security vulnerabilities that could be exploited by malicious sandboxed applications. These updates reinforce the importance of maintaining robust security and functionality in desktop sandboxing frameworks used widely across Linux distributions.