CVE-2026-39977: flatpak-builder Path Traversal Flaw

CVE-2026-39977 Overview

CVE-2026-39977 is a path traversal vulnerability in flatpak-builder, a tool used to build flatpak applications from source. The vulnerability exists in versions 1.4.5 through 1.4.7, where the license-files manifest key improperly handles path resolution, allowing attackers to read arbitrary files from the host system.

The flaw stems from insufficient validation when processing user-defined license file paths. The paths are resolved using g_file_resolve_relative_path() and validated with two checks that fail to properly handle symlinks. The g_file_get_relative_path() function does not resolve symlinks, and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS only applies to the final path component. Since the copy operation runs on the host, this allows attackers to escape the source directory and capture arbitrary files into the build output.

Critical Impact

Attackers can exploit this vulnerability to read sensitive files from the host system during the build process, potentially exposing credentials, configuration files, and other confidential data.

Affected Products

• flatpak-builder versions 1.4.5 to 1.4.7

Discovery Timeline

• April 9, 2026 - CVE CVE-2026-39977 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-39977

Vulnerability Analysis

This path traversal vulnerability (CWE-22) allows unauthorized file access through improper symlink handling in flatpak-builder's license file processing logic. When building flatpak applications, users can specify license files through the license-files manifest key, which accepts an array of paths relative to the module's source directory.

The vulnerability arises from the interaction between multiple path validation functions that, when combined, fail to prevent symlink-based directory escapes. The build process copies files on the host system, meaning any files accessible to the build process can be exfiltrated into the resulting flatpak package.

An attacker with the ability to provide a malicious manifest or source files can craft symlinks that pass the incomplete validation checks, ultimately allowing them to traverse outside the intended source directory and capture host system files into the build output.

Root Cause

The root cause is the incomplete symlink validation in the path resolution logic. The g_file_get_relative_path() function validates paths without resolving symlinks, while g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS only checks the final path component. This creates a gap where intermediate symlink components can be used to escape the source directory boundary before reaching the final validated path component.

Attack Vector

The attack requires a network-delivered malicious manifest or source archive that contains specially crafted symlinks. An attacker could:

1. Create a malicious flatpak source archive containing symlinks in intermediate path components
2. Configure the license-files manifest key to reference paths that traverse through these symlinks
3. When the victim builds the flatpak, the build process follows the symlinks and copies arbitrary host files
4. The exfiltrated files are embedded in the resulting flatpak package, accessible to the attacker

The attack requires user interaction (building the malicious package) but does not require any special privileges on the target system.

Detection Methods for CVE-2026-39977

Indicators of Compromise

• Unexpected symlinks within flatpak source directories, particularly those pointing to system paths like /etc/ or user home directories
• Build logs showing license file copies from paths outside the expected source directory hierarchy
• Flatpak packages containing files that should not be present in legitimate builds

Detection Strategies

• Monitor flatpak-builder processes for file access operations that traverse outside designated source directories
• Implement file integrity monitoring on sensitive system files to detect unauthorized read operations during build processes
• Scan incoming flatpak manifests for suspicious license-files configurations before building

Monitoring Recommendations

• Enable audit logging for file system access on systems where flatpak-builder is used regularly
• Review build outputs for unexpected files that may indicate successful exploitation
• Monitor for symlink creation in source directories during build preparation phases

How to Mitigate CVE-2026-39977

Immediate Actions Required

• Upgrade flatpak-builder to version 1.4.8 or later immediately
• Review recent builds for potentially compromised outputs if using affected versions
• Audit any flatpak manifests from untrusted sources before building

Patch Information

The vulnerability is fixed in flatpak-builder version 1.4.8. Users should update through their distribution's package manager or build from source using the patched release. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Avoid building flatpak packages from untrusted sources until the patch is applied
• Manually inspect the license-files array in manifests and verify that source directories do not contain suspicious symlinks before building
• Run flatpak-builder in a sandboxed or containerized environment to limit potential file access if building from untrusted sources is necessary