Vulnerability details

CVE-2026-42574

chainguard-dev apko

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

CVSS 3.1

7.5High

Official description

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
chainguard-dev	apko	>= 0.14.8, < 1.2.5	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6 x_refsource_CONFIRM
https://github.com/chainguard-dev/apko/pull/2187 x_refsource_MISC
https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442 x_refsource_MISC
https://github.com/chainguard-dev/apko/releases/tag/v1.2.5 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-09
Last updated: 2026-05-11
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.35%

Probability of exploitation in 30 days

29%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59
Improper Link Resolution Before File Access ('Link Following')