CVE-2025-53945: chainguard-dev apko Incorrect Default Permissions
CVSS: 7.0v3.1HighDeferred
AliasesCGA-2676-v5hx-q949CGA-27mh-9c57-qx2mCGA-33vp-7jm3-4fmmCGA-36c4-3x9x-7w7gCGA-389p-33cf-qm28CGA-3rr5-x8rq-8gppCGA-3x3p-gwhh-x2qvCGA-52h2-fj3g-m4wvCGA-5rrm-94p3-qc72CGA-8qx7-r695-5g9hCGA-98mf-h4hj-qv38CGA-c2mx-2qfp-g5x6CGA-c5c7-m4fx-v38jCGA-cm2v-jc7v-g72mCGA-cwf6-jx9j-ppcmCGA-cxqg-vcgr-xjvfCGA-f4hr-37qj-h9hhCGA-f5h2-jp25-qxf3CGA-gvfw-pqf3-pgx3CGA-hp5h-w89r-h8r5CGA-m6gh-55gh-c9qjCGA-mffj-wgvp-77hpCGA-p5mj-36m3-g4fhCGA-p9r6-9gvc-g3wwCGA-r68c-g65r-98x9CGA-r9cm-5795-f6qqCGA-rx59-px2x-w62xCGA-w2h6-m66j-4p93CGA-w7xc-fc26-2v8rCGA-xx2h-wxjw-qh8gGHSA-x6ph-r535-3vjwGO-2025-3816CGA-27jc-qpx7-m79hCGA-8f94-9f6h-mhvfCGA-cf98-2826-9vqcCGA-gvjj-jhhx-rpvvCGA-m5j2-x246-c9qwCGA-rjhw-jpvc-c9q6
Published 18-07-2025Last modified 22-07-2025
Vulnerability summary
CVE-2025-53945 is a high (CVSS 7.0) Incorrect Default Permissions vulnerability in chainguard-dev apko. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.1% of scored vulnerabilities.
CVSS score
7.0/10
010
High · v3.1 (CVE.org)EPSS score
0.14%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 18-07-2025PublishedVulnerability first disclosed.
- 22-07-2025Last modifiedVulnerability information updated.
Description
apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:LSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
- OSV · GoEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.02 pp
From 0.13% on 19-09-2026
19-09-202619-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard18 products
- cg< 0_git20250730-r0
- chainctl< 0.2.107-r0
- docker-credential-cgr< 0.2.107-r0
- gem-check< 0.0.19-r0
- gosh< 0.0.19-r0
Wolfi15 products
- gem-check< 0.0.19-r0
- gosh< 0.0.19-r0
- header-check< 0.0.19-r0
- help-check< 0.0.19-r0
- ldd-check< 0.0.19-r0
Chainguard-dev1 product
- apko≥ 0.27.0, < 0.29.5
Chainguard.dev1 product
- apko≥ 0.27.0, < 0.29.5
4 vendors · 35 products
References
8 links- github.com/chainguard-dev/apko/security/advisories/GHSA-x6ph-r535-3vjwX Refsource CONFIRMAdvisoryWEB
- github.com/chainguard-dev/apko/commit/04f37e2d50d5a502e155788561fb7d40de705bd9X Refsource MISCFIXWEB
- github.com/chainguard-dev/apko/commit/aedb0772d6bf6e74d8f17690946dbc791d0f6af3X Refsource MISCFIXWEB
