CVE-2025-54059
published 2025-07-18CVE-2025-54059: melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange…
PriorityP419medium4.4CVSS 3.1
AVLACLPRLUINSUCNILAL
EPSS
0.13%
2.6th percentile
melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainguard-dev | melange | — | — |
| chainguard.dev | melange | >= 0.23.0 < 0.29.5 | 0.29.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
osv·2025-07-29
CVE-2025-54059 melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
melange's world-writable permissions expose SBOM files to potential image tampering in chainguard.dev/melange
OSV
melange's world-writable permissions expose SBOM files to potential image tampering
osv·2025-07-18
CVE-2025-54059 [MEDIUM] melange's world-writable permissions expose SBOM files to potential image tampering
melange's world-writable permissions expose SBOM files to potential image tampering
It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:
```
$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2>/dev/null var/lib/db/sbom
drwxr-xr-x root/root 0 2025-06-23 14:17 var/lib/db/sbom
-rw-rw-rw- root/root 3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json
```
This issue was introduced in commit 1b272db ("Persist workspace filesystem throughout package builds (#1836)") ([v0.23.0](https://github.com/chainguard-dev/melange/releases/tag/v0.23.0)).
### Impact
This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentia
GHSA
melange's world-writable permissions expose SBOM files to potential image tampering
ghsa·2025-07-18
CVE-2025-54059 [MEDIUM] CWE-276 melange's world-writable permissions expose SBOM files to potential image tampering
melange's world-writable permissions expose SBOM files to potential image tampering
It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666:
```
$ apkrane ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2>/dev/null var/lib/db/sbom
drwxr-xr-x root/root 0 2025-06-23 14:17 var/lib/db/sbom
-rw-rw-rw- root/root 3383 2025-06-23 14:17 var/lib/db/sbom/hello-wolfi-2.12.2-r1.spdx.json
```
This issue was introduced in commit 1b272db ("Persist workspace filesystem throughout package builds (#1836)") ([v0.23.0](https://github.com/chainguard-dev/melange/releases/tag/v0.23.0)).
### Impact
This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentia
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/chainguard-dev/melange/commit/1b272db2a0bb3441553284cc56d87236b4b64c04https://github.com/chainguard-dev/melange/commit/e29494b4a40a91619ec1c87a09003c6d5164cea1https://github.com/chainguard-dev/melange/pull/1836https://github.com/chainguard-dev/melange/pull/2086https://github.com/chainguard-dev/melange/releases/tag/v0.23.0https://github.com/chainguard-dev/melange/releases/tag/v0.29.5https://github.com/chainguard-dev/melange/security/advisories/GHSA-5662-cv6m-63wh
2025-07-18
Published