CVE-2026-42574

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

CVSS 7.5 HIGHEPSS 0.4%CWE-22 CWE-59

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

09 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Produtos afetados

chainguard-dev · apko

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442 https://github.com/chainguard-dev/apko/pull/2187 https://github.com/chainguard-dev/apko/releases/tag/v1.2.5 https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6