Vulnerability · Published May 9, 2026 · Assigned by GitHub_M
CVE-2026-42574apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
High 7.5
In plain English
A high-severity path traversal in apko from chainguard-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | chainguard.dev/apko | 1.2.5 | GHSA-qq3r-w4hj-gjp6 |
| Go | chainguard.dev/apko | 1.2.5 | GO-2026-5589 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | apko | >= 0.14.8, < 1.2.5 |
Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6 x_refsource_CONFIRM
- https://github.com/chainguard-dev/apko/pull/2187 x_refsource_MISC
- https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442 x_refsource_MISC
- https://github.com/chainguard-dev/apko/releases/tag/v1.2.5 x_refsource_MISC