Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LicensingInfos function, which reads license files specified in the copyright.license-path field without validating that paths remain within the workspace directory. An attacker can access and exfiltrate...

CVE-2026-25145: Improper Limitation of a Pathname to a Restricted Directory

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

melange 路径遍历漏洞

Melange is a software developed by Chainguard for building APKs from source code. Versions of Melange from 0.14.0 to 0.40.3 had a path traversal vulnerability. This vulnerability occurred because the LicensingInfos function did not validate the path when reading license files, allowing for path...