CVE-2026-39977

OVERVIEW CVE-2026-39977 is a path traversal vulnerability in flatpak-builder versions 1.4.5 through 1.4.7 that affects the license-files manifest key functionality. The vulnerability exists in the validation logic for user-defined license file paths, which fails to properly resolve and sanitize symbolic links when copying files during the build process. An attacker can exploit this flaw by crafting a malicious manifest or source directory to read arbitrary files from the host system and include them in the build output. The issue has been remediated in version 1.4.8. SEVERITY The vulnerability carries a CVSS score of 6.3 (Medium severity) with a local attack vector requiring user interaction. It has low attack complexity, no privilege requirements, and results in high confidentiality impact with no integrity or availability impact. The weakness stems from incomplete symlink validation across two separate security checks, allowing attackers to bypass restrictions and access sensitive host files during build operations executed on the host system. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with no entries in the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00024 indicates this vulnerability ranks in the lowest percentile for probability of exploitation. Community attention appears minimal, and no public exploit code has been widely distributed. Organizations should prioritize patching to version 1.4.8, though the immediate risk profile remains low.