Vulnerability · Published Jul 18, 2025 · Assigned by GitHub_M
CVE-2025-53945apko has incorrect permission (0666) in /etc/ld.so.cache and other files
High 7.0
In plain English
A high-severity incorrect default permissions in apko from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | chainguard.dev/apko | 0.29.5 | GHSA-x6ph-r535-3vjw |
| Go | chainguard.dev/apko | 0.29.5 | GO-2025-3816 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | apko | >= 0.27.0, < 0.29.5 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
References
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw x_refsource_CONFIRM
- https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9 x_refsource_MISC
- https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3 x_refsource_MISC
- https://github.com/chainguard-dev/apko/releases/tag/v0.27.0 x_refsource_MISC
- https://github.com/chainguard-dev/apko/releases/tag/v0.29.5 x_refsource_MISC