DEBIAN-CVE-2026-39977
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-39977
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39977.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-39977
- Upstream
- Published
- 2026-04-09T20:16:26Z
- Modified
- 2026-09-14T17:03:32Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.
- References
Affected packages
Debian:14 / flatpak-builder
Package
- Name
- flatpak-builder
- Purl
- pkg:deb/debian/flatpak-builder?arch=source&distro=forky