CVE-2026-107466
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
37/100
Published: 2026-10-08
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
Low
A:
None
Description
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.