CVE-2026-39977: flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files
flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using gfileresolverelativepath() and validated to stay inside the source directory using two checks - gfilegetrelativepath() which does not resolve symlinks and gfilequeryfiletype() with GFILEQUERYINFONOFOLLOWSYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39977?
CVE-2026-39977 is classified as a medium severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2026-39977?
To fix CVE-2026-39977, update flatpak-builder to version 1.4.8 or later to mitigate the path traversal vulnerability.
What versions are affected by CVE-2026-39977?
Versions of flatpak-builder from 1.4.5 to before 1.4.8 are affected by CVE-2026-39977.
What type of vulnerability is CVE-2026-39977?
CVE-2026-39977 is a path traversal vulnerability that can lead to arbitrary file read on the host.
Who is affected by CVE-2026-39977?
Users and developers utilizing flatpak-builder versions between 1.4.5 and 1.4.8 are at risk from CVE-2026-39977.