CVE-2026-39977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39977", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-08T00:01:47.628Z", "datePublished": "2026-04-09T19:05:23.616Z", "dateUpdated": "2026-04-09T20:19:28.323Z"}, "containers": {"cna": {"title": "flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"}], "affected": [{"vendor": "flatpak", "product": "flatpak-builder", "versions": [{"version": ">= 1.4.5, < 1.4.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T19:05:23.616Z"}, "descriptions": [{"lang": "en", "value": "flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8."}], "source": {"advisory": "GHSA-6gm9-3g7m-3965", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T20:18:06.098366Z", "id": "CVE-2026-39977", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T20:19:28.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39977", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T20:18:06.098366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T20:18:15.728Z"}}], "cna": {"title": "flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files", "source": {"advisory": "GHSA-6gm9-3g7m-3965", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "flatpak", "product": "flatpak-builder", "versions": [{"status": "affected", "version": ">= 1.4.5, < 1.4.8"}]}], "references": [{"url": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965", "name": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T19:05:23.616Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39977", "state": "PUBLISHED", "dateUpdated": "2026-04-09T20:19:28.323Z", "dateReserved": "2026-04-08T00:01:47.628Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T19:05:23.616Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flatpak-builder", "vendor": "flatpak", "versions": [{"status": "affected", "version": ">= 1.4.5, < 1.4.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flatpak:flatpak-builder:*:*:*:*:*:*:*:*", "matchCriteriaId": "B096A702-9401-429C-AE2C-2474D632B2E7", "versionEndExcluding": "1.4.8", "versionStartIncluding": "1.4.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8."}, {"lang": "es", "value": "flatpak-builder es una herramienta para construir flatpaks desde el c\u00f3digo fuente. Desde 1.4.5 hasta antes de 1.4.8, la clave del manifiesto license-files acepta un array de rutas a archivos de licencia definidos por el usuario relativas al directorio fuente del m\u00f3dulo. Las rutas de ese array se resuelven usando g_file_resolve_relative_path() y se validan para permanecer dentro del directorio fuente mediante dos comprobaciones - g_file_get_relative_path() que no resuelve enlaces simb\u00f3licos y g_file_query_file_type() con G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS que solo se aplica al componente final de la ruta. La operaci\u00f3n de copia se ejecuta en el host. Esto puede ser explotado mediante el uso de un manifiesto y/o fuente manipulados para leer archivos arbitrarios del host y capturarlos en la salida de la construcci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 1.4.8."}], "id": "CVE-2026-39977", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39977", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T20:18:06.098366Z", "version": "2.0.3"}}]}, "published": "2026-04-09T20:16:26.660", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "flatpak-builder: path traversal leading to arbitrary file read on host when installing licence files", "id": "2457035", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457035"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in flatpak-builder. A specially crafted manifest or source can bypass path restrictions by using symbolic links within the `license-files` field, allowing the builder to follow paths outside the intended source directory, reading arbitrary files from the host system and including them in the build output. As a result, sensitive data from the host environment may be exposed in the resulting application package."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, audit untrusted manifests and sources for suspicious license-files paths. Additionally, consider running the build process inside a container or a restricted sandbox environment to ensure the builder cannot access sensitive host files or credentials."}, "name": "CVE-2026-39977", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "flatpak-builder", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-09T19:05:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39977\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39977\nhttps://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965"], "statement": "To exploit this issue, an attacker needs to convince a user to build a package via a crafted manifest or source, specifically, with a malicious `license-files` field. In automated build systems where untrusted packages may be processed, this issue can be exploited without user interaction but the attacker still has to introduce a malicious manifest into the build queue. Due to these reasons, this flaw has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.5,1.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "flatpak-builder", "source": "cna", "vendor": "flatpak"}, "product": "flatpak-builder", "vendor": "flatpak"}], "analysis": {"en": {"generated_at": "2026-04-09T20:52:57.255701+00:00", "value": {"mitigation_remediation": ["Update to flatpak-builder 1.4.8 or newer to fix path traversal handling.", "If upgrade is not possible immediately, avoid using untrusted or unverified manifests and ensure manifest files are sourced from trusted parties.", "Monitor for any security advisories from Flatpak regarding this issue."], "summary": {"action": "Apply patch", "impact": "Arbitrary file read on host"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in flatpak-builder versions 1.4.5 through 1.4.7 inclusive. Users running these versions should be aware that any build performed with an untrusted manifest can leak host files into the resulting package. The fix was introduced in version 1.4.8, which sanitises license file paths properly.", "description_and_impact": "flatpak-builder, a build tool used to create Flatpak packages, contains a path traversal flaw when processing the license-files key in a module's manifest. An attacker can supply a crafted manifest pointing to arbitrary files on the host filesystem, which flatpak-builder resolves using g_file_resolve_relative_path and then copies these files into the build output. This allows reading sensitive data such as configuration, credentials, or system files, compromising confidentiality. The weakness corresponds to CWE-22, which is a classic directory traversal exploitation.", "risk_and_exploitability": "CVSS 7.1 indicates a high risk of damage if exploited. The vulnerability requires local execution of the build process with a malicious manifest; therefore the attack vector is limited to systems that run flatpak-builder, typically developers or build servers. Although EPSS data is unavailable, the lack of a KeV listing suggests no public exploits yet, but the straightforward exploitation path makes it a moderate to high risk in environments that process untrusted build manifests. Upgrading or applying the vendor patch mitigates the risk."}}}}, "created": "2026-04-10T08:39:01.332454+00:00", "updated": "2026-04-10T09:29:46.370006+00:00", "vendors": ["flatpak", "flatpak$PRODUCT$flatpak-builder"]}