Skip to main content

Flatpak CVE-2026-39977

| EUVDEUVD-2026-21045 HIGH
Path Traversal (CWE-22)
2026-04-09 GitHub_M
Path Traversal Red Hat Suse Flatpak Flatpak Builder
7.1
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.3 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

7
Re-analysis Queued
Apr 16, 2026 - 21:07 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 06:00 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
1.4.8
EUVD ID Assigned
Apr 09, 2026 - 19:45 euvd
EUVD-2026-21045
Analysis Generated
Apr 09, 2026 - 19:45 vuln.today
CVE Published
Apr 09, 2026 - 19:05 nvd
HIGH 7.1

DescriptionGitHub Advisory

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.

AnalysisAI

Path traversal in flatpak-builder 1.4.5 through 1.4.7 enables arbitrary host file exfiltration through license-files manifest exploitation. Attacker-crafted manifest with symlink manipulation bypasses g_file_get_relative_path() and g_file_query_file_type() validation, allowing reads outside source directory. Successful exploitation requires user interaction (processing malicious manifest) but grants unauthenticated remote attackers high confidentiality impact with no authentication required. Publicly available exploit code exists. CVSS 7.1 reflects network vector with user participation prerequisite.

Technical ContextAI

Root cause: incomplete symlink validation in license-files path resolution. g_file_resolve_relative_path() resolves symlinks before g_file_get_relative_path() boundary check executes, while G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS only protects final component. Attacker chains intermediate symlinks to escape source directory containment during host-side copy operations, exploiting CWE-22 improper limitation of pathname.

RemediationAI

Vendor-released patch: upgrade to flatpak-builder version 1.4.8 immediately. This release implements corrected symlink validation logic preventing path traversal during license file resolution. No workarounds exist that preserve full functionality; organizations unable to upgrade should disable processing of untrusted flatpak-builder manifests and restrict manifest sources to verified internal repositories only. Validate all license-files entries before build execution in high-security environments. Full technical details and remediation guidance: https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965

More in Flatpak

View all
CVE-2026-34078 CRITICAL
9.3 Apr 07

Sandbox escape in Flatpak versions prior to 1.16.4 allows applications to access arbitrary host filesystem paths and ach
CVE-2019-10063 CRITICAL
9.0 Mar 26

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Rated critical sever
CVE-2021-21261 HIGH
8.8 Jan 14

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2018-6560 HIGH
8.8 Feb 02

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the
CVE-2026-34079 HIGH
8.7 Apr 07

Arbitrary file deletion in Flatpak versions prior to 1.16.4 allows sandboxed applications to delete files on the host sy
CVE-2021-21381 HIGH
8.2 Mar 11

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2019-8308 HIGH
8.2 Feb 12

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows at
CVE-2017-9780 HIGH
7.8 Jun 21

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate
CVE-2021-41133 HIGH
7.8 Oct 08

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated high severity
CVE-2026-34080 MEDIUM
6.8 Apr 07

Policy parser vulnerability in xdg-dbus-proxy prior to 0.1.7 allows authenticated local users to bypass eavesdrop restri
CVE-2023-28100 MEDIUM
6.5 Mar 16

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severi
CVE-2023-28101 MEDIUM
4.3 Mar 16

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Rated medium severi

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2026-39977 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy