CVE-2026-39977

A flaw was found in flatpak-builder. A specially crafted manifest or source can bypass path restrictions by using symbolic links within the license-files field, allowing the builder to follow paths outside the intended source directory, reading arbitrary files from the host system and including them in the build output. As a result, sensitive data from the host environment may be exposed in the resulting application package.

To exploit this issue, an attacker needs to convince a user to build a package via a crafted manifest or source, specifically, with a malicious license-files field. In automated build systems where untrusted packages may be processed, this issue can be exploited without user interaction but the attacker still has to introduce a malicious manifest into the build queue. Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.