Package: flatpak-builder Version: 1.4.10-1 Severity: important Tags: security help pending X-Debbugs-Cc: Debian Security Team <[email protected]>
https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-484h-v688-jq5j >In --sandbox mode, flatpak-builder is supposed to prevent >manifests from referencing sources outside the manifest directory. >This protection was only enforced for the dir source subtype >and file source subtype using a local path. > >It did not cover: > > * url: values using the file:// scheme > * archive, git, bzr, and svn source subtypes, which lacked > sandboxed-mode confinement checks entirely > * mirror-urls > >As a result, a manifest could use a file:// URI or a plain local >path to read or reference arbitrary files on the host filesystem >from within a sandboxed build, defeating the intended >containment. > >This is primarily relevant to systems building untrusted manifests. > >The exploitation is constrained under most cases due to either >requiring an exact checksum match, or previous access to the host >filesystem or external tools refusing to operate on file:// URI schemes >by default. Furthermore, sandboxed mode is not the default >mode of operation of flatpak-builder. There is no CVE for this, and upstream was unsure whether it's CVE-worthy. Like CVE-2026-86320, it's primarily interesting for repository-as-a-service providers that build untrusted or semi-trusted source code, like Flathub. I'll try to upload 1.4.11 to fix this and CVE-2026-86320 in unstable soon. If this needs fixing in trixie, either with a DSA or in a point release, I'd appreciate help. (Felix, would you be able to take this one?) smcv
