CVE-2026-24843 HIGH

CVE-2026-24843: melange QEMU runner could write files outside workspace directory

Vendor Chainguard-Dev
Product melange
Weakness CWE-22 · Path traversal
Published February 4, 2026
Last update February 5, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

What the vulnerability does

01Description

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.

Key dates

02Disclosure timeline

February 4, 2026 CVE published
February 5, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2016-7063 CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss CVE-2026-44716 Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator CVE-2024-7777 Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion CVE-2026-22926