High severity · published Feb 4, 2026
CVE-2026-25121
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apko · chainguard-dev
>= 0.14.8, < 1.1.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25121
Patch
https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14
Third Party Advisory
https://github.com/chainguard-dev/apko/security/advisories/GHSA-5g94-c2wx-8pxw
More from apko
8.3
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
7.5
CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
7.5
CVE-2026-42574
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
7.5
CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
7.0
CVE-2025-53945
apko has incorrect permission (0666) in /etc/ld.so.cache and other files