Executive brief
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
Affected products
- Go chainguard.dev/apko
Junglewise Threat Intelligence
CVE-2025-53945: GO-2025-3816 - apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
CVE-2025-53945 · Severity: low · CVSS 3.1 · Published 2025-07-29
Technologies: chainguard.dev/apko (Go). Vendors: Go.
Related threats
- melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to versi
- Chainguard apko denial of service via incorrect type assertion in DiscoverKeys
- Chainguard apko insufficient integrity check for apk packages
- Chainguard apko path traversal via symlink following in DirFS
- GO-2026-4410 - apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko