GitHub Advisoryadvisory · Go

GHSA-5g94-c2wx-8pxw apko has a path traversal in apko dirFS which allows filesystem writes outside base

HIGH Published 2026-02-03 Modified 2026-02-04 Official page ↗
Aliases
CVE-2026-25121
Ecosystem
Go
Packages
chainguard.dev/apko
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-23
Reviewed
2026-02-03

Affected packages

• Go chainguard.dev/apko: >= 0.14.8, < 1.1.0 → fixed in 1.1.0

Description

A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. Fix: Fixed by d8b7887. Merged into release. Acknowledgements apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-25121 apko allows users to build and publish OCI container images built from apk packages. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness

References