[Pkg-utopia-maintainers] Bug#1147701: flatpak-builder: GHSA-484h-v688-jq5j: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes

[Salvatore Bonaccorso]

Control: retitle -1 flatpak-builder: CVE-2026-107466: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes

On Mon, Sep 14, 2026 at 01:39:11PM +0100, Simon McVittie wrote:
> Package: flatpak-builder
> Version: 1.4.10-1
> Severity: important
> Tags: security help pending
> X-Debbugs-Cc: Debian Security Team <team at security.debian.org>
> 
> https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-484h-v688-jq5j
> >In --sandbox mode, flatpak-builder is supposed to prevent
> >manifests from referencing sources outside the manifest directory.
> >This protection was only enforced for the dir source subtype
> >and file source subtype using a local path.
> >
> >It did not cover:
> >
> >  * url: values using the file:// scheme
> >  * archive, git, bzr, and svn source subtypes, which lacked
> >    sandboxed-mode confinement checks entirely
> >  * mirror-urls
> >
> >As a result, a manifest could use a file:// URI or a plain local
> >path to read or reference arbitrary files on the host filesystem
> >from within a sandboxed build, defeating the intended
> >containment.
> >
> >This is primarily relevant to systems building untrusted manifests.
> >
> >The exploitation is constrained under most cases due to either
> >requiring an exact checksum match, or previous access to the host
> >filesystem or external tools refusing to operate on file:// URI schemes
> >by default. Furthermore, sandboxed mode is not the default
> >mode of operation of flatpak-builder.
> 
> There is no CVE for this, and upstream was unsure whether it's 
> CVE-worthy. Like CVE-2026-86320, it's primarily interesting for 
> repository-as-a-service providers that build untrusted or semi-trusted 
> source code, like Flathub.
> 
> I'll try to upload 1.4.11 to fix this and CVE-2026-86320 in unstable soon.
> 
> If this needs fixing in trixie, either with a DSA or in a point release, 
> I'd appreciate help. (Felix, would you be able to take this one?)

Looks this got a CVE assigned, CVE-2026-107466.

Regards,
Salvatore