High severity · published May 9, 2026
CVE-2026-42574
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
apko · chainguard-dev
>= 0.14.8, < 1.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42574
github.com
https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442
github.com
https://github.com/chainguard-dev/apko/pull/2187
github.com
https://github.com/chainguard-dev/apko/releases/tag/v1.2.5
github.com
https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6
More from apko
8.3
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
7.5
CVE-2026-42575
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
7.5
CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
7.5
CVE-2026-25121
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
7.0
CVE-2025-53945
apko has incorrect permission (0666) in /etc/ld.so.cache and other files