Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-25145melange has a path traversal in license-path which allows reading files outside workspace
Medium 5.5
In plain English
A medium-severity path traversal in melange from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | chainguard.dev/melange | 0.40.3 | GHSA-2w4f-9fgg-q2v9 |
| Go | chainguard.dev/melange | 0.40.3 | GO-2026-4409 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | melange | >= 0.14.0, < 0.40.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N