A flaw in flatpak-builder allows an attacker to cause information disclosure by creating a malicious build manifest. By inserting local file URIs into source download definitions, the builder ignores directory confinement checks and can read sensitive files from the host file system. The attacker can then include the contents of those files in the resulting build artifacts, exposing confidential data.

The vulnerability affects the flatpak-builder package on Red Hat Enterprise Linux 8, 9 and 10. Any system running one of these RHEL versions with flatpak-builder installed may be compromised if it processes a crafted build manifest.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a trusted build process that accepts a maliciously crafted build manifest; the attacker must supply the manifest to a system that uses flatpak-builder. Successful exploitation leads to arbitrary host file contents being read, thereby compromising data confidentiality.