flatpak-builder vulnerabilities

Latest flatpak-builder CVEs

Newest publication first

1. CVE-2026-39977 flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files

   Published 2026-04-09

   High·CVSS 7.1 EPSS 0.30%

   flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are resolved using g_file_resolve_re...

2. CVE-2022-21682 flatpak-builder can access files outside the build directory.

   Published 2022-01-13

   Medium·CVSS 6.5 EPSS 1.8%

   Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.