CVE-2026-107466: flatpak-builder local file disclosure via crafted manifest

CVE-2026-107466 · Severity: medium · CVSS 6.1 · Published 2026-10-08

flatpak-builder is a tool used by developers and CI systems to package applications into Flatpak containers. A flaw in directory confinement allows an attacker to trick users into processing malicious build manifests that read arbitrary host files and incorporate them into build artifacts, exposing sensitive data like credentials and configuration. Exploitation requires social engineering or injection into a CI pipeline rather than remote attack.

Quick answers

Is CVE-2026-107466 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-107466 being exploited in the wild.
How severe is CVE-2026-107466?
Medium severity, with a CVSS score of 6.1, published 8 October 2026.
Which products and versions are affected?
flatpak-builder.
Is there a fix for CVE-2026-107466?
No fixed version is recorded yet. Avoid processing build manifests from untrusted sources, execute builds in isolated ephemeral container or VM environments without access to sensitive files or credentials, and implement pre-build pipeline checks to reject manifests containing file:// URI schemes in source definitions. Alternatively, uninstall flatpak-builder if Flatpak packaging is not required.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107466 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-107466?
Check whether you run Flatpak-Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Avoid processing build manifests from untrusted sources, execute builds in isolated ephemeral container or VM environments without access to sensitive files or credentials, and implement pre-build pipeline checks to reject manifests containing file:// URI schemes in source definitions. Alternatively, uninstall flatpak-builder if Flatpak packaging is not required.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-08"}]

Technical details

A path traversal vulnerability in flatpak-builder's source download handling allows local file URIs (file://) to bypass directory confinement checks, enabling read access to host files accessible by the build process user. The vulnerability is a CWE-22 (improper pathname restriction) that requires user interaction or CI pipeline manipulation; an attacker cannot exploit it over the network. A fix exists but is not named in the advisory.

Affected products

  • flatpak-builder

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.