CVE-2026-25121High· 7.5▾ Twilightapko has a path traversal in apko dirFS which allows filesystem writes outside base
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.
Fix: Fixed by d8b7887. Merged into release.
Acknowledgements
apko thanks Oleh Konko from 1seal for discovering and reporting this issue.
chainguard.dev/apko >= 0.14.8, < 1.1.0Upgrade to a patched release:
chainguard.dev/apko 1.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-25122Medium· 5.5apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
CVE-2026-42576Noneapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
CVE-2026-42575Noneapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko