Login Request a demo
High severity · published Jul 18, 2025
CVE-2025-53945
apko has incorrect permission (0666) in /etc/ld.so.cache and other files
7.0
CVSS
0.1%
EPSS
No
On KEV
Description
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apko · chainguard-dev
>= 0.27.0, < 0.29.5 · source: vendor
Affected product
AP
apko
chainguard-dev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53945
github.com
https://github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9
github.com
https://github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3
github.com
https://github.com/chainguard-dev/apko/releases/tag/v0.27.0
github.com
https://github.com/chainguard-dev/apko/releases/tag/v0.29.5
github.com
https://github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjw
More from apko
8.3
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
7.5
CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
7.5
CVE-2026-42574
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
7.5
CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
7.5
CVE-2026-25121
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base