Control: retitle -1 flatpak-builder: CVE-2026-107466: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes
On Mon, Sep 14, 2026 at 01:39:11PM +0100, Simon McVittie wrote: > Package: flatpak-builder > Version: 1.4.10-1 > Severity: important > Tags: security help pending > X-Debbugs-Cc: Debian Security Team <[email protected]> > > https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-484h-v688-jq5j > >In --sandbox mode, flatpak-builder is supposed to prevent > >manifests from referencing sources outside the manifest directory. > >This protection was only enforced for the dir source subtype > >and file source subtype using a local path. > > > >It did not cover: > > > > * url: values using the file:// scheme > > * archive, git, bzr, and svn source subtypes, which lacked > > sandboxed-mode confinement checks entirely > > * mirror-urls > > > >As a result, a manifest could use a file:// URI or a plain local > >path to read or reference arbitrary files on the host filesystem > >from within a sandboxed build, defeating the intended > >containment. > > > >This is primarily relevant to systems building untrusted manifests. > > > >The exploitation is constrained under most cases due to either > >requiring an exact checksum match, or previous access to the host > >filesystem or external tools refusing to operate on file:// URI schemes > >by default. Furthermore, sandboxed mode is not the default > >mode of operation of flatpak-builder. > > There is no CVE for this, and upstream was unsure whether it's > CVE-worthy. Like CVE-2026-86320, it's primarily interesting for > repository-as-a-service providers that build untrusted or semi-trusted > source code, like Flathub. > > I'll try to upload 1.4.11 to fix this and CVE-2026-86320 in unstable soon. > > If this needs fixing in trixie, either with a DSA or in a point release, > I'd appreciate help. (Felix, would you be able to take this one?) Looks this got a CVE assigned, CVE-2026-107466. Regards, Salvatore
