{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39977", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.628Z", "datePublished": "2026-04-09T19:05:23.616Z", "dateUpdated": "2026-04-09T20:19:28.323Z"}, "containers": {"cna": {"title": "flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"}], "affected": [{"vendor": "flatpak", "product": "flatpak-builder", "versions": [{"version": ">= 1.4.5, < 1.4.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T19:05:23.616Z"}, "descriptions": [{"lang": "en", "value": "flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8."}], "source": {"advisory": "GHSA-6gm9-3g7m-3965", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T20:18:06.098366Z", "id": "CVE-2026-39977", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T20:19:28.323Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:*", "matchCriteriaId": "B096A702-9401-429C-AE2C-2474D632B2E7", "versionEndExcluding": "1.4.8", "versionStartIncluding": "1.4.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8."}], "id": "CVE-2026-39977", "lastModified": "2026-04-16T20:52:42.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-09T20:16:26.660", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "flatpak-builder: path traversal leading to arbitrary file read on host when installing licence files", "id": "2457035", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457035"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in flatpak-builder. A specially crafted manifest or source can bypass path restrictions by using symbolic links within the `license-files` field, allowing the builder to follow paths outside the intended source directory, reading arbitrary files from the host system and including them in the build output. As a result, sensitive data from the host environment may be exposed in the resulting application package."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, audit untrusted manifests and sources for suspicious license-files paths. Additionally, consider running the build process inside a container or a restricted sandbox environment to ensure the builder cannot access sensitive host files or credentials."}, "name": "CVE-2026-39977", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-09T19:05:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39977\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39977\nhttps://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"], "statement": "To exploit this issue, an attacker needs to convince a user to build a package via a crafted manifest or source, specifically, with a malicious `license-files` field. In automated build systems where untrusted packages may be processed, this issue can be exploited without user interaction but the attacker still has to introduce a malicious manifest into the build queue. Due to these reasons, this flaw has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.5,1.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "flatpak-builder", "source": "cna", "vendor": "flatpak"}, "product": "flatpak-builder", "vendor": "flatpak"}], "analysis": {"en": {"generated_at": "2026-04-09T20:52:57.255701+00:00", "value": {"mitigation_remediation": ["Update to flatpak-builder 1.4.8 or newer to fix path traversal handling.", "If upgrade is not possible immediately, avoid using untrusted or unverified manifests and ensure manifest files are sourced from trusted parties.", "Monitor for any security advisories from Flatpak regarding this issue."], "summary": {"action": "Apply patch", "impact": "Arbitrary file read on host"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in flatpak-builder versions 1.4.5 through 1.4.7 inclusive. Users running these versions should be aware that any build performed with an untrusted manifest can leak host files into the resulting package. The fix was introduced in version 1.4.8, which sanitises license file paths properly.", "description_and_impact": "flatpak-builder, a build tool used to create Flatpak packages, contains a path traversal flaw when processing the license-files key in a module's manifest. An attacker can supply a crafted manifest pointing to arbitrary files on the host filesystem, which flatpak-builder resolves using g_file_resolve_relative_path and then copies these files into the build output. This allows reading sensitive data such as configuration, credentials, or system files, compromising confidentiality. The weakness corresponds to CWE-22, which is a classic directory traversal exploitation.", "risk_and_exploitability": "CVSS 7.1 indicates a high risk of damage if exploited. The vulnerability requires local execution of the build process with a malicious manifest; therefore the attack vector is limited to systems that run flatpak-builder, typically developers or build servers. Although EPSS data is unavailable, the lack of a KeV listing suggests no public exploits yet, but the straightforward exploitation path makes it a moderate to high risk in environments that process untrusted build manifests. Upgrading or applying the vendor patch mitigates the risk."}}}}, "created": "2026-04-10T08:39:01.332454+00:00", "updated": "2026-04-10T09:29:46.370006+00:00", "vendors": ["flatpak", "flatpak$PRODUCT$flatpak-builder"]}