CVE-2026-25121
published 2026-02-04CVE-2026-25121: apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.42%
36.0th percentile
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chainguard-dev | apko | — | — |
| chainguard.dev | apko | >= 0.14.8 < 1.1.0 | 1.1.0 |
| chainguard.dev | apko | >= 0.14.8 < 1.2.5 | 1.2.5 |
| chainguard | apko | >= 0.14.8 < 1.1.1 | 1.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
ghsa·2026-05-04
CVE-2026-42574 [HIGH] CWE-22 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
### Impact
A crafted `.apk` could install a `TypeSymlink` tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the `sanitizePath` helper in `pkg/apk/fs/rwosfs.go`, which rejected only lexical `..` traversal and did not resolve or refuse symlinks. Every disk-backed `DirFS` method that handed its caller-supplied path to a symlink-following stdlib call — `ReadFile`, `WriteFile`, `Chmod`, `Chown`, `Chtimes`, `MkdirAll`, `Mkdir`, and `Mknod` — was affected. The reachable primitive from a malicious APK du
OSV
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
osv·2026-02-05
CVE-2026-25121 apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
GHSA
apko has a path traversal in apko dirFS which allows filesystem writes outside base
ghsa·2026-02-03
CVE-2026-25121 [HIGH] CWE-22 apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.
**Fix:** Fixed by [d8b7887](https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14). Merged into release.
**Acknowledgements**
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
OSV
apko has a path traversal in apko dirFS which allows filesystem writes outside base
osv·2026-02-03
CVE-2026-25121 [HIGH] apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.
**Fix:** Fixed by [d8b7887](https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14). Merged into release.
**Acknowledgements**
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-25121 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-25121 [HIGH] CVE-2026-25121 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25121 :
NixOS vulnerability analysis and mitigation
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
Source : NVD
## 7.5
Score
Published February 4, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
NixOS
AWS Systems Manage
Bugzilla
CVE-2026-107445 rubygem-katello: katello: katello: Katello Flatpak Remote Repositories API cross-organization authorization bypass
bugzilla·2026-10-08·CVSS 5.4
CVE-2026-107445 [MEDIUM] CVE-2026-107445 rubygem-katello: katello: katello: Katello Flatpak Remote Repositories API cross-organization authorization bypass
CVE-2026-107445 rubygem-katello: katello: katello: Katello Flatpak Remote Repositories API cross-organization authorization bypass
A flaw was found in Katello. The Flatpak Remote Repositories API resolves records with an unscoped FlatpakRemoteRepository.find in a before_action used by show and mirror, while the index path correctly uses FlatpakRemoteRepository.readable. An authenticated user with view_flatpak_remotes in one organization can read another organization's flatpak remote repository metadata. The same unscoped finder backs the mirror action, which creates a repository in a product the attacker can edit using the victim organization's flatpak remote registry URL and stored remote credentials (username/token). Reported via PSIRTSUPT-25121.
2026-02-04
Published