CVE-2026-39977
Path Traversal in flatpak-builder License-Files Allows Host File Disclosure
Publication date: 2026-04-09
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flatpak | flatpak-builder | From 1.4.5 (inc) to 1.4.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to read arbitrary files from the host system and include them in build outputs, potentially exposing sensitive information such as environment variables and secret tokens.
In environments like distributed build or continuous integration (CI) systems, where sensitive data such as central secrets or tokens may be present, this can lead to unauthorized disclosure of confidential information.
Such unauthorized exposure of sensitive data could lead to non-compliance with regulations like GDPR or HIPAA, which require protection of personal and sensitive information from unauthorized access and disclosure.
Can you explain this vulnerability to me?
CVE-2026-39977 is a high-severity path traversal vulnerability in flatpak-builder versions 1.4.5 through 1.4.7, fixed in version 1.4.8. The vulnerability arises from the way the tool handles the license-files manifest key, which specifies license file paths relative to the source directory.
The paths are resolved and validated to stay inside the source directory using checks that do not properly handle symbolic links or path traversal sequences. This improper validation allows crafted manifests or source archives to specify license file paths that escape the source directory.
As a result, an attacker can cause arbitrary files from the host system to be read and copied into the build output, potentially exposing sensitive information.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to read arbitrary files from the host system during the build process and include them in the build output. This can lead to the exposure of sensitive information such as environment variables, secret tokens, or personal configuration files.
While the impact is considered low for local users who typically trust manifests, it poses a significant risk in distributed build or continuous integration (CI) environments where central secrets or tokens are stored.
Attackers can exploit this vulnerability to exfiltrate sensitive information from CI hosts into build artifacts that are then distributed to users, potentially compromising security and confidentiality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting flatpak-builder manifests and source archives for the presence of symlinks or path traversal sequences in the license-files array that escape the source directory.
Specifically, you can look for symlinks inside the source directory that point outside the directory, such as to /proc/self or user home directories.
Suggested commands to detect suspicious symlinks or paths include:
- Find symlinks inside the source directory: `find /path/to/source -type l -ls`
- Check where symlinks point: `readlink -f /path/to/source/symlink`
- Search for license-files entries in manifests that contain ../ or absolute paths: `grep -r license-files /path/to/manifests`
- Verify if any license file paths resolve outside the source directory by scripting path resolution checks.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade flatpak-builder to version 1.4.8 or later, where this vulnerability is fixed.
Until upgrading, avoid using untrusted manifests or source archives that specify license-files, especially in distributed build or CI environments.
Additionally, audit existing manifests and source directories for symlinks or license file paths that could escape the source directory and remove or correct them.
Restrict build environments to trusted users and inputs to reduce the risk of exploitation.