CVE-2026-42574: chainguard-dev apko Path Traversal
Vulnerability summary
CVE-2026-42574 is a high (CVSS 7.5) Path Traversal vulnerability in chainguard-dev apko. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 09-05-2026PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.16 pp
From 0.35% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected systems
Chainguard1 product
- dagdotdev< 0.0.20-r14
Chainguard-dev1 product
- apko≥ 0.14.8, < 1.2.5
Chainguard.dev1 product
- apko≥ 0.14.8, < 1.2.5
Wolfi1 product
- dagdotdev< 0.0.20-r14
4 vendors · 4 products
References
7 links- github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6X Refsource CONFIRMAdvisoryWEB
- github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442X Refsource MISCFIXWEB
