Executive brief
apko is a tool used to build and publish secure container images from software packages. A vulnerability was found where a specially crafted package could trick the tool into writing files outside of the intended build directory on the host system. This could allow an attacker to overwrite sensitive files on the server or build machine, potentially disrupting operations or compromising the integrity of the build environment.
Technical details
A path traversal vulnerability exists in apko's DirFS implementation due to improper link resolution in the sanitizePath helper within pkg/apk/fs/rwosfs.go. While the helper blocked lexical '..' traversal, it failed to resolve or restrict symlinks. An attacker can provide a crafted .apk containing a TypeSymlink tar entry pointing to a host path; subsequent file-write or directory-creation entries in the archive will then follow this symlink to escape the build root. Affected methods include ReadFile, WriteFile, MkdirAll, and others when backed by disk storage. The issue is resolved in version 1.2.5 by migrating filesystem operations to use os.Root (introduced in Go 1.24), which natively restricts traversal.
Affected products
- Chainguard apko >= 0.14.8, < 1.2.5
Timeline
- 2026-04-22: patched: Fix committed and version 1.2.5 released
- 2026-04-23: advisory: GitHub Security Advisory GHSA-qq3r-w4hj-gjp6 published
- 2026-05-09: disclosed: CVE-2026-42574 published to NVD