CVE-2026-42574: Chainguard apko path traversal via symlink following in DirFS

CVE-2026-42574 · Severity: high · CVSS 7.5 · Published 2026-05-09

apko is a tool used to build and publish secure container images from software packages. A vulnerability was found where a specially crafted package could trick the tool into writing files outside of the intended build directory on the host system. This could allow an attacker to overwrite sensitive files on the server or build machine, potentially disrupting operations or compromising the integrity of the build environment.

Technologies: Chainguard Apko, chainguard.dev/apko (Go). Vendors: Chainguard, Go.

Quick answers

Is CVE-2026-42574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42574 being exploited in the wild.
How severe is CVE-2026-42574?
High severity, with a CVSS score of 7.5, published 9 May 2026.
Which products and versions are affected?
Chainguard Apko >= 0.14.8, < 1.2.5; chainguard.dev/apko (Go) >= 0.14.8, < 1.2.5, SEMVER:introduced=0.14.8,fixed=1.2.5.
Is there a fix for CVE-2026-42574?
Yes. chainguard.dev/apko (Go): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42574 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42574?
Check whether you run Chainguard Apko or chainguard.dev/apko (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • chainguard.dev/apko (Go): upgrade to 1.2.5 or later
    go get chainguard.dev/apko@v1.2.5

Technical details

A path traversal vulnerability exists in apko's DirFS implementation due to improper link resolution in the sanitizePath helper within pkg/apk/fs/rwosfs.go. While the helper blocked lexical '..' traversal, it failed to resolve or restrict symlinks. An attacker can provide a crafted .apk containing a TypeSymlink tar entry pointing to a host path; subsequent file-write or directory-creation entries in the archive will then follow this symlink to escape the build root. Affected methods include ReadFile, WriteFile, MkdirAll, and others when backed by disk storage. The issue is resolved in version 1.2.5 by migrating filesystem operations to use os.Root (introduced in Go 1.24), which natively restricts traversal.

Affected products

  • Chainguard apko >= 0.14.8, < 1.2.5

Identifiers

  • CVE-2026-42574
  • GHSA-qq3r-w4hj-gjp6
  • GO-2026-5589

Timeline

  • 2026-04-22: patched: Fix committed and version 1.2.5 released
  • 2026-04-23: advisory: GitHub Security Advisory GHSA-qq3r-w4hj-gjp6 published
  • 2026-05-09: disclosed: CVE-2026-42574 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.