Evidence used
- No CISA KEV confirmation is currently recorded.
- EPSS is 0.19% for the current model date.
BlackTreeCVE IntelligenceFull vulnerability report · 2026
CVE-2026-107466High confidence
Flatpak-builder: local file exfiltration via `file
Red Hat · Red Hat Enterprise Linux 10
6.1MediumCVSS 3.1
Scheduled
Fix not verifiedMedium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.
R
Open reassessment dashboard →Operational reassessment
Published severity in operational context
Published severityMedium→Operational priority:Medium, unchanged from published severity.unchanged
Compensating controls
- Restrict local access and enforce least privilege on affected hosts.
- Monitor vendor guidance and exploitation sources for a material change.
Verification
- Confirm that the asset runs Red Hat Red Hat Enterprise Linux 10 and falls inside the recorded affected range.
- Recheck the vendor advisory before scheduling a change because no verified fixed version is currently retained.
- Validate exposure, authentication requirements and compensating controls in the actual environment.
- Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Distribution package intelligence
4 package statesRelease-specific package status
Debian findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
Repository candidate not checked
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Debian trixietrixie · source | flatpak-builder | Affected, no fix publishedDebian currently tracks this release as open. | Not published in this feed | Debian Security Tracker ↗Source updated 9 Oct 2026 |
| Debian bookwormbookworm · source | flatpak-builder | Affected, no fix publishedDebian currently tracks this release as open. | Not published in this feed | Debian Security Tracker ↗Source updated 9 Oct 2026 |
| Debian forkyforky · source | flatpak-builder | Vendor fix publishedDebian records a fixed source-package version for this release. | 1.4.11-1 | Debian Security Tracker ↗Source updated 9 Oct 2026 |
| Debian sidsid · source | flatpak-builder | Vendor fix publishedDebian records a fixed source-package version for this release. | 1.4.11-1 | Debian Security Tracker ↗Source updated 9 Oct 2026 |
Direct vendor intelligence
2 currentAuthoritative vendor CSAF and VEX advisories
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
CVE-2026-107466 · CSAF 2.0 · revision 2 · interimSUSE Product Security TeamCVE-2026-107466
The vendor explicitly identifies these products as affected by this CVE.
- flatpak-builder as component of SUSE Linux Enterprise Desktop 15 SP7
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP1
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP2
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP3
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP4
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP5
- flatpak-builder as component of SUSE Linux Enterprise Module for Development Tools 15 SP7
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP1-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP1
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP2-LTSS
- Summary
- A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
- Remediation
- No remediation text is recorded.
CVE-2026-107466 · CSAF 2.0 · revision 3 · finalRed Hat Product Securityflatpak-builder: Local File Exfiltration via `file
The vendor explicitly identifies these products as affected by this CVE.
- flatpak-builder.src as a component of Red Hat Enterprise Linux 10
- flatpak-builder as a component of Red Hat Enterprise Linux 8
- flatpak-builder.src as a component of Red Hat Enterprise Linux 8
- flatpak-builder.src as a component of Red Hat Enterprise Linux 9
- Summary
- A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
- Remediation
- If Flatpak packaging is not required on the system, remove the flatpak-builder package to eliminate exposure: # dnf remove flatpak-builder For development environments and continuous integration pipelines where flatpak-builder is necessary, apply the following operational controls: 1. Avoid processing build manifests from untrusted or unverified third-party sources. 2. Execute builds within isolated, ephemeral container or virtual machine environments where sensitive host files and credentials are not mounted or accessible. 3. Implement pre-build pipeline checks to reject manifests containing `file://` URI schemes in `type: file` or `type: archive` source definitions.
Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.
Fix not verified01
What, why and how
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
What
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
Why
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
How
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may obtain information outside the intended access boundary.
What
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
Why
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
How
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may obtain information outside the intended access boundary.
02
Exploit reality and attack path
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
Observed exploitation No confirmed evidence
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
Public PoC / exploit material None recorded
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
- Likely attack path
- local access → Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') → obtain information outside the intended access boundary
- Attack surface
- Local
- Privileges required
- None: unauthenticated exploitation is possible
- User interaction
- Required interaction required
- Attack complexity
- Low: no specialised conditions are recorded
- Security boundary
- Unchanged: impact remains within the vulnerable component's security authority
- Weakness
?
CWE means Common Weakness Enumeration: a standard category for the underlying weakness. - CWE-22 ↗
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CVSS vector
?
CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity. CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UIRequiredUser interaction: Another user must perform an action for exploitation to succeed.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.ILowIntegrity impact: A successful attack can cause a limited loss.ANoneAvailability impact: No direct loss is represented by this metric.- Post-exploitation / living off the land
- The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.
03
Patch and workaround
Operational remediation based on structured source evidence.
- Status
?
Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change. - Fix not verified
- Affected
- flatpak-builder as component of SUSE Linux Enterprise Desktop 15 SP7
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP1
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP2
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP3
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP4
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
- flatpak-builder as component of SUSE Linux Enterprise High Performance Computing 15 SP5
- flatpak-builder as component of SUSE Linux Enterprise Module for Development Tools 15 SP7
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP1-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP1
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP2-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP2
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP3-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP3
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP4-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP4
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP5-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP5
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP6-LTSS
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP6
- flatpak-builder as component of SUSE Linux Enterprise Server 15 SP7
- flatpak-builder as component of SUSE Linux Enterprise Server Teradata 15 SP4
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP1
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6
- flatpak-builder as component of SUSE Linux Enterprise Server for SAP Applications 15 SP7
- Fixed
- No fixed version is explicitly recorded in the structured CVE data.
- Action
- No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
- Workaround
- No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.
04
Evidence and provenance
Published 8 Oct 2026 · Last source change 8 Oct 2026, 17:54 UTC · CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE recordCVE.org · 5.2
CVSS sourceCNA
EPSS source FIRST · tracked since 2026-10-08
?
The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.European sourceENISA EUVD · EUVD-2026-94800
Product sourceVendor CSAF · SUSE Product Security Team
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCNA
NVD statusNVD awaiting enrichment
Core structured fields are present and their contributing authorities are shown above.
Material change intelligence
View recent updates ↗What changed after publication
- ENISA EUVD mappingEUVD-2026-94800 was added to the official ENISA EUVD mapping for this CVE.ENISA EUVD ↗
- Before
- not recorded
- After
- {"euvdId":"EUVD-2026-94800"}
- Catalogue recordCVE added to the BlackTree catalogue.CNA ↗
Technical terms and abbreviations used in this report
- CVE
- Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
- CVSS
- Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
- EPSS
- Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
- CWE
- Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
- CNA
- CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
- CISA ADP
- Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
- NVD
- National Vulnerability Database: NIST's enrichment service for CVE records.
- CERT / CSIRT
- A computer security incident response team that publishes warnings or coordinates incident response.
- PoC
- Proof of concept: public material that demonstrates or helps reproduce exploitation.
- CSAF
- Common Security Advisory Framework: a machine-readable format for security advisories.
- LoTL
- Living off the land: abuse of legitimate tools or system functions during an attack.