{"id":"CVE-2026-25145","aliases":["GHSA-2w4f-9fgg-q2v9","GO-2026-4409"],"title":"melange has a path traversal in license-path which allows reading files outside workspace ","summary":"melange has a path traversal in license-path which allows reading files outside workspace ","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","vendor":"melange","product":"chainguard.dev/melange","ecosystem":"go","affected":["chainguard.dev/melange >= 0.14.0, < 0.40.3"],"patched":["chainguard.dev/melange 0.40.3"],"published":"2026-02-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:33.764030501Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2w4f-9fgg-q2v9","references":[{"url":"https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25145"},{"url":"https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4"},{"url":"https://github.com/chainguard-dev/melange"}],"tags":["osv","go"],"epss":0.00175,"epssPercentile":0.07222,"ingestedAt":"2026-09-12T03:13:01.746Z","slug":"CVE-2026-25145","body":"## Overview\n\nAn attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.                                                                                                                                                                      \n                                                                                                                                                                                        \n  Fix: Merged in commit 2f95c9f4\n                                                                                                                                                                                        \n  Acknowledgements                                                                                                                                                                      \n                                                                                                                                                                                        \nmelange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.\n\n## Affected packages\n\n- `chainguard.dev/melange >= 0.14.0, < 0.40.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `chainguard.dev/melange 0.40.3`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}