CVE-2026-107466

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.

This vulnerability is rated as Moderate severity because exploitation requires an attacker to convince a user or automated pipeline to execute a malicious manifest, rather than permitting unauthenticated remote execution. In Red Hat Enterprise Linux, flatpak-builder is an on-demand developer utility rather than an exposed network daemon or persistent service. Although the directory confinement mechanism does not isolate local URI references during source downloads, read operations remain constrained to host files accessible by the user account executing the command.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Flatpak packaging is not required on the system, remove the flatpak-builder package to eliminate exposure:

dnf remove flatpak-builder

For development environments and continuous integration pipelines where flatpak-builder is necessary, apply the following operational controls:

1. Avoid processing build manifests from untrusted or unverified third-party sources.
2. Execute builds within isolated, ephemeral container or virtual machine environments where sensitive host files and credentials are not mounted or accessible.
3. Implement pre-build pipeline checks to reject manifests containing file:// URI schemes in type: file or type: archive source definitions.