CVE-2026-25145

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LicensingInfos function, which reads license files specified in the copyright.license-path field without validating that paths remain within the workspace directory. An attacker can access and exfiltrate...

CVE-2026-25145: Improper Limitation of a Pathname to a Restricted Directory

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

Melange path traversal vulnerability

Melange is a software developed by Chainguard for building APKs from source code. Versions of Melange from 0.14.0 to 0.40.3 had a path traversal vulnerability. This vulnerability occurred because the LicensingInfos function did not validate the path when reading license files, allowing for path...