Executive Summary

CVE-2026-39977 is a high-severity path traversal vulnerability in flatpak-builder versions 1.4.5 through 1.4.7, fixed in version 1.4.8. The vulnerability arises from the way the tool handles the license-files manifest key, which specifies license file paths relative to the source directory.

The paths are resolved and validated to stay inside the source directory using checks that do not properly handle symbolic links or path traversal sequences. This improper validation allows crafted manifests or source archives to specify license file paths that escape the source directory.

As a result, an attacker can cause arbitrary files from the host system to be read and copied into the build output, potentially exposing sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to read arbitrary files from the host system during the build process and include them in the build output. This can lead to the exposure of sensitive information such as environment variables, secret tokens, or personal configuration files.

While the impact is considered low for local users who typically trust manifests, it poses a significant risk in distributed build or continuous integration (CI) environments where central secrets or tokens are stored.

Attackers can exploit this vulnerability to exfiltrate sensitive information from CI hosts into build artifacts that are then distributed to users, potentially compromising security and confidentiality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting flatpak-builder manifests and source archives for the presence of symlinks or path traversal sequences in the license-files array that escape the source directory.

Specifically, you can look for symlinks inside the source directory that point outside the directory, such as to /proc/self or user home directories.

Suggested commands to detect suspicious symlinks or paths include:

• Find symlinks inside the source directory: `find /path/to/source -type l -ls`
• Check where symlinks point: `readlink -f /path/to/source/symlink`
• Search for license-files entries in manifests that contain ../ or absolute paths: `grep -r license-files /path/to/manifests`
• Verify if any license file paths resolve outside the source directory by scripting path resolution checks.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade flatpak-builder to version 1.4.8 or later, where this vulnerability is fixed.

Until upgrading, avoid using untrusted manifests or source archives that specify license-files, especially in distributed build or CI environments.

Additionally, audit existing manifests and source directories for symlinks or license file paths that could escape the source directory and remove or correct them.

Restrict build environments to trusted users and inputs to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to read arbitrary files from the host system and include them in build outputs, potentially exposing sensitive information such as environment variables and secret tokens.

In environments like distributed build or continuous integration (CI) systems, where sensitive data such as central secrets or tokens may be present, this can lead to unauthorized disclosure of confidential information.

Such unauthorized exposure of sensitive data could lead to non-compliance with regulations like GDPR or HIPAA, which require protection of personal and sensitive information from unauthorized access and disclosure.

Useful 0 Not Useful 0