Cloudanix VulnDB

CVE-2026-25121

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Feb 4, 2026

CISA due date

—

The record

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.

Affected packages

Ecosystem Package Introduced Fixed
Go chainguard.dev/apko 0.14.8 1.1.0
Chainguard amazon-ssm-agent 0 3.3.3270.0-r5
Chainguard amazon-ssm-agent-ecs-exec 0 3.3.3270.0-r5
Chainguard cg 0 0.2.201-r0
Chainguard chainctl 0 0.2.206-r0
Chainguard dagdotdev 0 0.0.20-r6
Wolfi dagdotdev 0 0.0.20-r6
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260205T172317-150000.1.146.1

Related vulnerabilities