Read the docs
TI-2026-28833 Aliases CVE-2026-39977

flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files

Priority MEDIUM 64CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed flatpak-builder (flatpak): 1.4.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flatpakflatpak-builder1.4.5 to before 1.4.81.4.8Patch availableCNA
  • flatpak-builder Vendorflatpak Affected 1.4.5 to before 1.4.8 Fixed in 1.4.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:*1.4.5 to before 1.4.8Vulnerableflatpak
  • cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:* Versions 1.4.5 to before 1.4.8 Vulnerable ·flatpak

Remediation

  • Fix · CNA flatpak-builder (flatpak) Fixed in 1.4.8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39977

References

Exploit 1

  • TI-2022-06058 flatpak-builder can access files outside the build directory. CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences