CVE-2026-42574

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42574

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42574.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-42574

Aliases

Downstream

Related

openSUSE-SU-2026:21483-1

Published

2026-05-09T19:24:48Z

Modified

2026-10-16T02:59:36Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

Details

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42574.json"
}

References

Affected packages

Git / github.com/chainguard-dev/apko

Affected ranges

Type

GIT

Repo

https://github.com/chainguard-dev/apko

Events

Introduced

95e33993764a6a6f7cc4098453260cc6da7e71a1

Fixed

f5a96e1299ac81c7ea9441705ec467688086f442

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.14.8"
                },
                {
                    "fixed":  "1.2.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "f5a96e1299ac81c7ea9441705ec467688086f442"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.2.5",
            "range":  [
                {
                    "fixed":  "f5a96e1299ac81c7ea9441705ec467688086f442"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.2.5"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*

0.27.8

v0.*

v0.14.8

v0.14.9

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.18.1

v0.19.0

v0.19.1

v0.19.2

v0.19.3

v0.19.4

v0.19.5

v0.19.6

v0.19.7

v0.19.8

v0.19.9

v0.20.0

v0.20.1

v0.20.2

v0.21.0

v0.22.1

v0.22.2

v0.22.3

v0.22.4

v0.22.5

v0.22.6

v0.22.7

v0.23.0

v0.24.0

v0.25.0

v0.25.1

v0.25.2

v0.25.3

v0.25.4

v0.25.5

v0.25.6

v0.25.7

v0.26.0

v0.26.1

v0.27.0

v0.27.1

v0.27.2

v0.27.3

v0.27.4

v0.27.5

v0.27.6

v0.27.7

v0.27.9

v0.28.0

v0.29.0

v0.29.1

v0.29.10

v0.29.2

v0.29.3

v0.29.4

v0.29.5

v0.29.6

v0.29.7

v0.29.8

v0.29.9

v0.30.0

v0.30.1

v0.30.10

v0.30.11

v0.30.12

v0.30.13

v0.30.14

v0.30.15

v0.30.16

v0.30.17

v0.30.18

v0.30.19

v0.30.2

v0.30.20

v0.30.21

v0.30.22

v0.30.23

v0.30.24

v0.30.25

v0.30.26

v0.30.27

v0.30.28

v0.30.29

v0.30.3

v0.30.30

v0.30.31

v0.30.32

v0.30.33

v0.30.34

v0.30.35

v0.30.4

v0.30.5

v0.30.6

v0.30.7

v0.30.8

v0.30.9

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.1.0

v1.1.1

v1.1.10

v1.1.11

v1.1.12

v1.1.13

v1.1.14

v1.1.15

v1.1.16

v1.1.2

v1.1.3

v1.1.4

v1.1.5

v1.1.6

v1.1.7

v1.1.8

v1.1.9

v1.2.0

v1.2.1

v1.2.2

v1.2.3

v1.2.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-42574.json"