# CVE-2026-39977: flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key…

Source: https://junglewise.ai/threats/cve-2026-39977-flatpak-builder-is-a-tool-to-build-flatpaks-from-source-from-1-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09  
License: CC BY 4.0 with a link back

CVE-2026-39977 · Severity: medium · CVSS 6.3 · Published 2026-04-09

flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_relative_path() and validated to stay inside the source directory using two checks - g_file_get_relative_path() which does not resolve symlinks and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS which only applies to the final path component. The copy operation runs on host. This can be exploited by using a crafted manifest and/or source to read arbitrary files from the host and capture them into the build output. This vulnerability is fixed in 1.4.8.

Technologies: [Flatpak-Builder](https://junglewise.ai/threats/technologies/flatpak-builder). Vendors: [Flatpak](https://junglewise.ai/threats/vendors/flatpak).

## Quick answers

**Is CVE-2026-39977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39977 being exploited in the wild.

**How severe is CVE-2026-39977?** Medium severity, with a CVSS score of 6.3, published 9 April 2026.

**Which products and versions are affected?** Flatpak-Builder. The advisory does not name versions.

**Is there a fix for CVE-2026-39977?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-39977?** Check whether you run Flatpak-Builder. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Flatpak-Builder

## Related threats

- [flatpak-builder arbitrary code execution via Git hooks in patch sources](https://junglewise.ai/threats/cve-2026-86320-flatpak-builder-arbitrary-code-execution-via-git-hooks-in-patch)