CVE-2025-53945CWE-276

apko has incorrect permission (0666) in /etc/ld.so.cache and other files

High · published July 18, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00143 · 3.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-07-18T15:35Z
EPSS history
Timeline
  • 18 JUL 15:35Z
    apko has incorrect permission (0666) in /etc/ld.so.cache and other files
    cvelistv5