CVE-2026-42574 HIGH

CVE-2026-42574: apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

Vendor Chainguard-Dev
Product apko
Weakness CWE-22 · Path traversal
Published May 9, 2026
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

Key dates

02Disclosure timeline

May 9, 2026 CVE published
May 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-6109 javahongxi whatsmars InitializrController.java initialize path traversal CVE-2025-7098 Comodo Internet Security Premium File Name path traversal CVE-2025-3043 GuoMinJim PersonManage login preHandle path traversal CVE-2026-34653 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CVE-2023-32177 VIPRE Antivirus Plus DeleteHistoryFile Directory Traversal Local Privilege Escalation Vulnerability