CVE-2025-53945
published 2025-07-18CVE-2025-53945: apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files…
PriorityP430high7CVSS 3.1
AVLACHPRLUINSCCHILAL
EPSS
0.12%
2.0th percentile
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainguard-dev | apko | — | — |
| chainguard.dev | apko | >= 0.27.0 < 0.29.5 | 0.29.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
osv·2025-07-29
CVE-2025-53945 apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
GHSA
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
ghsa·2025-07-18
CVE-2025-53945 [HIGH] CWE-276 apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`:
```
bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache
```
This issue was introduced in commit [04f37e2 ("generate /etc/ld.so.cache (#1629)")](https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9)([v0.27.0](https://github.com/chainguard-dev/apko/releases/tag/v0.27.0)).
### Impact
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
### Patches
This issue was addressed in apk
OSV
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
osv·2025-07-18
CVE-2025-53945 [HIGH] apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`:
```
bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache
```
This issue was introduced in commit [04f37e2 ("generate /etc/ld.so.cache (#1629)")](https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9)([v0.27.0](https://github.com/chainguard-dev/apko/releases/tag/v0.27.0)).
### Impact
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
### Patches
This issue was addressed in apk
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3https://github.com/chainguard-dev/apko/releases/tag/v0.27.0https://github.com/chainguard-dev/apko/releases/tag/v0.29.5https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw
2025-07-18
Published