A flaw was found in flatpak-builder. (CVE-2026-107466)

CVE-2026-107466 is a vulnerability in flatpak-builder where an attacker can cause information disclosure by convincing a user or continuous integration system to process a maliciously crafted build manifest. The vulnerability arises because the builder bypasses directory confinement checks when local file URIs are specified within source download definitions. This allows the build process to read sensitive host files and incorporate them into build artifacts, potentially exposing confidential information. The vulnerability affects numerous specific versions of flatpak-builder as listed. There is no information provided about available patches or fixes.

An attacker can cause information disclosure by exploiting this vulnerability, leading to sensitive host files being read and included in build artifacts. This could expose confidential data to unauthorized parties. The vulnerability requires user interaction or CI system processing of a crafted build manifest and does not allow privilege escalation or denial of service. The CVSS score of 6.1 reflects a medium severity impact with high confidentiality impact but low integrity and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing build manifests from untrusted sources to avoid exposure of sensitive host files.