Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-39977: Flatpak-builder may let attackers read host files

CVE-2026-39977 · published 6 months ago

Summary

Versions of flatpak-builder from 1.4.5 up to 1.4.7 let a specially crafted build script copy any file from the computer into the package it is creating. This means an attacker could obtain private files from the machine where the package is built. Upgrade flatpak-builder to version 1.4.8 or later to stop the issue.

What to do

Update flatpak flatpak-builder to version 1.4.8 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	flatpak-builder	All versions
–	flatpak	flatpak-builder	>= 1.4.5, < 1.4.8 `cpe:2.3:a:flatpak:flatpak-builder::::::::`

Original advisory text

flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.

References

https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-39... Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-39977 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39977... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39977 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published9 Apr 2026

Updated3 Nov 2026

First seen9 Apr 2026

Sources

CVE-2026-39977 · NVD

DEBIAN-CVE-2026-39977 · OSV

CVE-2026-39977 · OSV

GHSA-6gm9-3g7m-3965 · GHSA

Track software like this

Free during beta