CVE-2026-25121
published 2026-02-04CVE-2026-25121: apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.37%
29.2th percentile
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainguard-dev | apko | — | — |
| chainguard.dev | apko | >= 0.14.8 < 1.1.0 | 1.1.0 |
| chainguard.dev | apko | >= 0.14.8 < 1.2.5 | 1.2.5 |
| chainguard | apko | >= 0.14.8 < 1.1.1 | 1.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
ghsa·2026-05-04
CVE-2026-42574 [HIGH] CWE-22 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
### Impact
A crafted `.apk` could install a `TypeSymlink` tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the `sanitizePath` helper in `pkg/apk/fs/rwosfs.go`, which rejected only lexical `..` traversal and did not resolve or refuse symlinks. Every disk-backed `DirFS` method that handed its caller-supplied path to a symlink-following stdlib call — `ReadFile`, `WriteFile`, `Chmod`, `Chown`, `Chtimes`, `MkdirAll`, `Mkdir`, and `Mknod` — was affected. The reachable primitive from a malicious APK du
OSV
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
osv·2026-02-05
CVE-2026-25121 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
GHSA
apko has a path traversal in apko dirFS which allows filesystem writes outside base
ghsa·2026-02-03
CVE-2026-25121 [HIGH] CWE-22 apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.
**Fix:** Fixed by [d8b7887](https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14). Merged into release.
**Acknowledgements**
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
OSV
apko has a path traversal in apko dirFS which allows filesystem writes outside base
osv·2026-02-03
CVE-2026-25121 [HIGH] apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.
**Fix:** Fixed by [d8b7887](https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14). Merged into release.
**Acknowledgements**
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
No detection rules found.
No public exploits indexed.
2026-02-04
Published