https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:10:15.197906+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-po41193 CLEANSTART-2026-PO41193 — Security fix for CVE-2026-42574 applied in: melange 0.50.0-r1 2026-10-03T07:10:15.265652+00:00

Affected: CleanStart: melange

Security vulnerability affects the melange package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-309973 EUVD-2026-309973 2026-10-03T07:10:15.265730+00:00 EUVD-2026-309973 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42574 fkie_cve-2026-42574 2026-10-03T07:10:15.265754+00:00

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

 https://cve.radiocsirt.org/vuln/ghsa-qq3r-w4hj-gjp6 GHSA-qq3r-w4hj-gjp6 — apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root 2026-10-03T07:10:15.265793+00:00

Affected: Go: chainguard.dev/apko

### Impact

A crafted `.apk` could install a `TypeSymlink` tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the `sanitizePath` helper in `pkg/apk/fs/rwosfs.go`, which rejected only lexical `..` traversal and did not resolve or refuse symlinks. Every disk-backed `DirFS` method that handed its caller-supplied path to a symlink-following stdlib call — `ReadFile`, `WriteFile`, `Chmod`, `Chown`, `Chtimes`, `MkdirAll`, `Mkdir`, and `Mknod` — was affected. The reachable primitive from a malicious APK during tar extraction is the `MkdirAll` / `Mkdir` / `WriteFile` chain via `apko build-cpio` and disk-backed consumers such as `melange`; the remaining sinks are reachable by direct callers of the `pkg/apk/fs` package. The in-memory `tarfs` install path used by `apko build`, `apko publish`, and `apko build-minirootfs` is not affected.

### Patches

Fixed in apko **v1.2.5** by [#2187](https://github.com/chainguard-dev/apko/pull/2187) / commit [f5a96e1](https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442), which scopes all `DirFS` operations through a Go 1.24 `*os.Root`. The `sanitizePath` helper has been removed; `*os.Root` refuses traversal via `..`, absolute-target symlinks, relative-target symlinks, and hardlinks by construction. Regression tests in `pkg/apk/apk/pa…