CVE-2026-42574CWE-22CWE-59

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

High · published May 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00513 · 42.8th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-05-09T19:24Z
EPSS history
Timeline
  • 09 MAY 19:24Z
    apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
    cvelistv5