CVE-2026-42574

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42574", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T17:26:12.085Z", "datePublished": "2026-05-09T19:24:48.497Z", "dateUpdated": "2026-05-11T17:11:40.244Z"}, "containers": {"cna": {"title": "apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6"}, {"name": "https://github.com/chainguard-dev/apko/pull/2187", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/apko/pull/2187"}, {"name": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442"}, {"name": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5"}], "affected": [{"vendor": "chainguard-dev", "product": "apko", "versions": [{"version": ">= 0.14.8, < 1.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:24:48.497Z"}, "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5."}], "source": {"advisory": "GHSA-qq3r-w4hj-gjp6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T17:09:56.626237Z", "id": "CVE-2026-42574", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T17:11:40.244Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42574", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T17:09:56.626237Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T17:11:17.756Z"}}], "cna": {"title": "apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root", "source": {"advisory": "GHSA-qq3r-w4hj-gjp6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "chainguard-dev", "product": "apko", "versions": [{"status": "affected", "version": ">= 0.14.8, < 1.2.5"}]}], "references": [{"url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6", "name": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chainguard-dev/apko/pull/2187", "name": "https://github.com/chainguard-dev/apko/pull/2187", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442", "name": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5", "name": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-09T19:24:48.497Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42574", "state": "PUBLISHED", "dateUpdated": "2026-05-11T17:11:40.244Z", "dateReserved": "2026-04-28T17:26:12.085Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-09T19:24:48.497Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "apko", "vendor": "chainguard-dev", "versions": [{"status": "affected", "version": ">= 0.14.8, < 1.2.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5."}, {"lang": "es", "value": "apko permite a los usuarios construir y publicar im\u00e1genes de contenedor OCI creadas a partir de paquetes apk. Desde la versi\u00f3n 0.14.8 hasta antes de la versi\u00f3n 1.2.5, un .apk manipulado podr\u00eda instalar una entrada tar TypeSymlink cuyo objetivo apuntaba fuera de la ra\u00edz de construcci\u00f3n, y una entrada posterior de creaci\u00f3n de directorio o escritura de archivo en el mismo archivo o en uno posterior podr\u00eda atravesar ese enlace simb\u00f3lico para alcanzar rutas del host a las que el usuario de construcci\u00f3n podr\u00eda escribir. Este problema ha sido parcheado en la versi\u00f3n 1.2.5."}], "id": "CVE-2026-42574", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42574", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T17:09:56.626237Z", "version": "2.0.3"}}]}, "published": "2026-05-09T20:16:29.420", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442"}, {"source": "security-advisories@github.com", "url": "https://github.com/chainguard-dev/apko/pull/2187"}, {"source": "security-advisories@github.com", "url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.14.8,1.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "apko", "source": "cna", "vendor": "chainguard-dev"}, "product": "apko", "vendor": "chainguard-dev"}], "created": "2026-05-09T20:30:40.834941+00:00", "updated": "2026-05-09T21:00:12.731676+00:00", "vendors": ["chainguard-dev", "chainguard-dev$PRODUCT$apko"]}