CVE-2026-39977: flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key…
CVE-2026-39977 · Severity: medium · CVSS 6.3 · Published 2026-04-09
flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.
No. Junglewise Threat Intelligence has no report of CVE-2026-39977 being exploited in the wild.
How severe is CVE-2026-39977?
Medium severity, with a CVSS score of 6.3, published 9 April 2026.
Which products and versions are affected?
Flatpak-Builder. The advisory does not name versions.
Is there a fix for CVE-2026-39977?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-39977?
Check whether you run Flatpak-Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.