CVE-2026-107466
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
Risk Assessment
An attacker can read sensitive host files and incorporate them into build artifacts, leading to information disclosure. This requires convincing a user or CI system to process a malicious manifest.
Recommendation
Update flatpak-builder to a patched version. Avoid processing untrusted build manifests and restrict build process access to sensitive files.
Other vulnerabilities in flatpak-builder
See all- CVE-2026-86320High
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process.
- CVE-2026-39977Medium
flatpak-builder from 1.4.5 to before 1.4.8 allows reading arbitrary host files via the license-files manifest key because path validation does not resolve symlinks in intermediate components. Copied files end up in the build output; the issue is fixed in 1.4.8.
Original NVD description (English source)
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS