---
id: CVE-2026-25145
aliases:
  - GHSA-2w4f-9fgg-q2v9
  - GO-2026-4409
title: >-
  melange has a path traversal in license-path which allows reading files
  outside workspace 
summary: >-
  melange has a path traversal in license-path which allows reading files
  outside workspace 
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
vendor: melange
product: chainguard.dev/melange
ecosystem: go
affected:
  - 'chainguard.dev/melange >= 0.14.0, < 0.40.3'
patched:
  - chainguard.dev/melange 0.40.3
published: '2026-02-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:33.764030501Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2w4f-9fgg-q2v9'
references:
  - url: >-
      https://github.com/chainguard-dev/melange/security/advisories/GHSA-2w4f-9fgg-q2v9
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25145'
  - url: >-
      https://github.com/chainguard-dev/melange/commit/2f95c9f4355ed993f2670bf1bb82d88b0f65e9e4
  - url: 'https://github.com/chainguard-dev/melange'
tags:
  - osv
  - go
epss: 0.00178
epssPercentile: 0.06539
ingestedAt: '2026-09-12T03:13:01.746Z'
---

## Overview

An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.                                                                                                                                                                      
                                                                                                                                                                                        
  Fix: Merged in commit 2f95c9f4
                                                                                                                                                                                        
  Acknowledgements                                                                                                                                                                      
                                                                                                                                                                                        
melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

## Affected packages

- `chainguard.dev/melange >= 0.14.0, < 0.40.3`

## Remediation

Upgrade to a patched release:

- `chainguard.dev/melange 0.40.3`