{"id":"CVE-2026-39977","aliases":["DEBIAN-CVE-2026-39977","EUVD-2026-21045","GHSA-6gm9-3g7m-3965","UBUNTU-CVE-2026-39977","openSUSE-SU-2026:10590-1"],"status":"published","title":"flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00299,"percentile":0.22884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-09T19:05:23Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Debian:14","package":"flatpak-builder","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"flatpak-builder","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"flatpak-builder","fixed_in":["1.4.8-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}],"versions":["1.4.4-2","1.4.5-1","1.4.6-1","1.4.6-2","1.4.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4-2","1.4.4-2build1","1.4.5-1","1.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}],"versions":["1.4.6-2","1.4.7-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1.1"}]}]}],"products":[{"vendor":"flatpak","product":"flatpak-builder"}],"references":[{"url":"https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39977.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39977","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-39977","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-39977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39977","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39977","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-39977","title":"flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T19:05:23.616Z","modified":"2026-04-09T20:19:28.323Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-21045","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T19:05:23Z","modified":"2026-04-09T20:19:28Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:24:30.341772Z"}],"nvd":[{"id":"CVE-2026-39977","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T20:16:26.66Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-39977","title":"flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T19:05:23.616Z","modified":"2026-10-28T02:31:07.007402253Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-39977","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T20:16:26.66Z","modified":"2026-10-26T11:47:24.647554477Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-39977","description":"flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.","status":"published","published":"2026-04-09T20:16:00Z","modified":"2026-05-20T16:25:38.531287082Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"openSUSE-SU-2026:10590-1","title":"flatpak-builder-1.4.8-1.1 on GA media","description":"These are all security issues fixed in the flatpak-builder-1.4.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-21T00:00:00Z","modified":"2026-04-22T08:16:25.263514Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}