CVE-2025-54059CWE-276

melange creates SBOM files in APKs with world-writable permissions

Medium · published July 18, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
4.1
In the wild
Unconfirmed
What it is

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00153 · 4.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-07-18T15:40Z
EPSS history
Timeline
  • 18 JUL 15:40Z
    melange creates SBOM files in APKs with world-writable permissions
    cvelistv5