CVE-2026-39977: 
NixOS vulnerability analysis and mitigation

CVE-2026-39977 is a path traversal vulnerability in flatpak-builder that allows an attacker to read arbitrary files from the host system and capture them into the build output. It affects flatpak-builder versions 1.4.5 through 1.4.7 — the range introduced when automatic license file detection and the license-files manifest key were added. The vulnerability was published on April 9, 2026, and fixed in version 1.4.8. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is a path traversal flaw (CWE-22) in the find_defined_license_files() function within src/builder-module.c. When processing the license-files manifest key, paths are resolved via g_file_resolve_relative_path() and validated using two checks: g_file_get_relative_path(), which does not resolve symlinks, and g_file_query_file_type() with G_FILE_QUERY_INFO_NOFOLLOW_SYMLINKS, which only applies to the final path component — not intermediate directories. An attacker can place a symlink in an intermediate directory of the source archive (e.g., exploit/licenses -> /proc/self) so that the validation checks pass while the subsequent copy operation, which runs on the host, follows the symlink and reads files outside the intended source directory. Exploitation requires a crafted manifest and/or source archive, and user interaction (running flatpak-builder) (GitHub Advisory).

Successful exploitation allows an attacker to read arbitrary files from the host filesystem and embed them into the flatpak build output, which may then be distributed to end users. The primary impact is a high confidentiality breach — sensitive data such as CI/CD secrets, environment variables, SSH keys, or configuration files can be exfiltrated. There is no integrity or availability impact. The risk is particularly acute in shared CI/CD environments where build outputs are distributed, as any user with the ability to submit a manifest could capture centrally stored secrets (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, containing complete, step-by-step reproduction instructions using crafted YAML manifests and symlink setups. The EPSS score is approximately 0.046% (low probability of near-term exploitation). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — a user must run flatpak-builder against a malicious manifest — but requires no special privileges (GitHub Advisory).

1. Prepare the malicious source archive: Create a directory structure with a symlink at an intermediate path component pointing to a sensitive host location, e.g., mkdir -p exploit && ln -s /proc/self exploit/licenses && tar czf exploit.tar.gz exploit/.
2. Craft a malicious manifest: Write a flatpak YAML manifest that references the archive as a source and specifies a license-files path that traverses through the symlink, e.g., license-files: [licenses/environ].
3. Deliver the manifest and archive: Distribute the crafted manifest and archive to a target user or CI/CD pipeline that will run flatpak-builder (e.g., via a pull request, a shared build system, or a malicious upstream source).
4. Trigger the build: The victim runs flatpak-builder build --force-clean --user test.yaml, causing find_defined_license_files() to resolve the symlink path and copy the target host file into the build output directory.
5. Retrieve the exfiltrated data: The sensitive file is now embedded in the build output at a path such as build/files/share/licenses/<app-id>/<module>/<filename>, readable by the attacker or distributed to end users (GitHub Advisory).

• File System: Presence of symlinks in intermediate directories of a flatpak source archive (e.g., exploit/licenses -> /proc/self or exploit/licenses -> /home/<user>); unexpected sensitive files (e.g., .zshrc, environ, SSH keys) appearing under build/files/share/licenses/<app-id>/ in flatpak build output directories.
• Logs: Build logs from flatpak-builder showing successful processing of license-files entries that reference paths through symlinked intermediate directories; build outputs containing files not originating from the declared source module.
• Process: flatpak-builder process accessing files outside the expected source directory during a build, observable via strace or auditd file access monitoring (e.g., reads to /proc/self/environ, /home/<user>/.zshrc, or other sensitive paths) (GitHub Advisory).

Upgrade flatpak-builder to version 1.4.8 or later, which contains the fix for this vulnerability. Fedora advisories have been issued for Fedora 42 and Fedora 44 packages. Until patching is complete, restrict the ability to run flatpak-builder against untrusted manifests or source archives, particularly in CI/CD environments. Review existing build outputs for unexpected files that may have been captured via this vulnerability, and rotate any secrets that may have been exposed (GitHub Advisory, Linux Security Fedora).

The vulnerability was reported and published by bbhtt via the GitHub Security Advisory program. Coverage has appeared on Linux security news aggregators and German Linux community site pro-linux.de, noting the information disclosure risk. Tenable released Nessus detection plugins (IDs 310071 and 310213) for the vulnerability. No major vendor statements or significant social media discussion beyond standard security advisory channels have been observed (Tenable, Linux Security Fedora).