[Pkg-utopia-maintainers] Bug#1147701: flatpak-builder: GHSA-484h-v688-jq5j: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes

[Simon McVittie]

Package: flatpak-builder
Version: 1.4.10-1
Severity: important
Tags: security help pending
X-Debbugs-Cc: Debian Security Team <team at security.debian.org>

https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-484h-v688-jq5j
>In --sandbox mode, flatpak-builder is supposed to prevent
>manifests from referencing sources outside the manifest directory.
>This protection was only enforced for the dir source subtype
>and file source subtype using a local path.
>
>It did not cover:
>
>  * url: values using the file:// scheme
>  * archive, git, bzr, and svn source subtypes, which lacked
>    sandboxed-mode confinement checks entirely
>  * mirror-urls
>
>As a result, a manifest could use a file:// URI or a plain local
>path to read or reference arbitrary files on the host filesystem
>from within a sandboxed build, defeating the intended
>containment.
>
>This is primarily relevant to systems building untrusted manifests.
>
>The exploitation is constrained under most cases due to either
>requiring an exact checksum match, or previous access to the host
>filesystem or external tools refusing to operate on file:// URI schemes
>by default. Furthermore, sandboxed mode is not the default
>mode of operation of flatpak-builder.

There is no CVE for this, and upstream was unsure whether it's 
CVE-worthy. Like CVE-2026-86320, it's primarily interesting for 
repository-as-a-service providers that build untrusted or semi-trusted 
source code, like Flathub.

I'll try to upload 1.4.11 to fix this and CVE-2026-86320 in unstable soon.

If this needs fixing in trixie, either with a DSA or in a point release, 
I'd appreciate help. (Felix, would you be able to take this one?)

    smcv