flatpak-builder vulnerabilities

A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process.

flatpak-builder from 1.4.5 to before 1.4.8 allows reading arbitrary host files via the license-files manifest key because path validation does not resolve symlinks in intermediate components. Copied files end up in the build output; the issue is fixed in 1.4.8.