flatpak-builder, a build tool used to create Flatpak packages, contains a path traversal flaw when processing the license-files key in a module's manifest. An attacker can supply a crafted manifest pointing to arbitrary files on the host filesystem, which flatpak-builder resolves using g_file_resolve_relative_path and then copies these files into the build output. This allows reading sensitive data such as configuration, credentials, or system files, compromising confidentiality. The weakness corresponds to CWE-22, which is a classic directory traversal exploitation.

The vulnerability exists in flatpak-builder versions 1.4.5 through 1.4.7 inclusive. Users running these versions should be aware that any build performed with an untrusted manifest can leak host files into the resulting package. The fix was introduced in version 1.4.8, which sanitises license file paths properly.

CVSS 7.1 indicates a high risk of damage if exploited. The vulnerability requires local execution of the build process with a malicious manifest; therefore the attack vector is limited to systems that run flatpak-builder, typically developers or build servers. Although EPSS data is unavailable, the lack of a KeV listing suggests no public exploits yet, but the straightforward exploitation path makes it a moderate to high risk in environments that process untrusted build manifests. Upgrading or applying the vendor patch mitigates the risk.