CVE-2026-39977 flatpak CVE debrief

Who should care

Defenders responsible for building and deploying flatpaks using flatpak-builder should assess their exposure and take necessary actions to mitigate the vulnerability. The vulnerability has a CVSS score of 7.1 and is considered HIGH. The affected versions are from 1.4.5 to before 1.4.8. Defenders should prioritize verifying and upgrading to version 1.4.8 or later, and review their build processes for potential exposure.

Why it matters

CVE-2026-39977 is a high-severity vulnerability in flatpak-builder that allows for potential unauthorized file disclosure and capture of sensitive host files. Defenders should prioritize verifying and upgrading to version 1.4.8 or later, and review their build processes for potential exposure.

• Potential unauthorized file disclosure
• Possible capture of sensitive host files
• Verification of build process integrity
• Upgrade to fixed version 1.4.8 or later

Technical summary

The vulnerability in flatpak-builder allows for reading arbitrary files from the host and capturing them into the build output by exploiting the license-files manifest key. This issue is fixed in version 1.4.8. The vulnerability has a CVSS score of 7.1 and is considered HIGH. The affected versions are from 1.4.5 to before 1.4.8. The vulnerability is caused by the license-files manifest key taking an array of paths to user-defined license files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_

Defensive priority

Defenders should prioritize verifying and upgrading to flatpak-builder version 1.4.8 or later, and review their build processes for potential exposure.

Recommended defensive actions

• Verify and upgrade to flatpak-builder version 1.4.8 or later
• Review build processes for potential exposure
• Monitor build outputs for suspicious files
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by the license-files manifest key taking an array of paths to user-defined license files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.