CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

CVE-2026-42574

The CVE-2026-42574 issue affects apko dirFS used to build/publish OCI images. A crafted APK could place a TypeSymlink tar entry whose target points outside the build root, enabling traversal to host paths via subsequent directory creation or write operations within the same or later archive. Root...

CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

apko 代码问题漏洞

Apko is an open-source OCI image builder based on APK. Versions of Apko prior to 1.2.7 had code vulnerabilities. These vulnerabilities stemmed from DiscoverKeys’ unconditional assertion of JWKS key types as rsa.PublicKey without checking the key type. This could lead to panic and crashes due to...

apko 数据伪造问题漏洞

Apko is an open-source OCI image builder based on APK. Versions of Apko prior to 1.2.7 had a data manipulation vulnerability. This vulnerability stemmed from verifying the APKINDEX.tar.gz signature but failing to compare the downloaded.apk package with the checksum in the signature index. This...

apko 路径遍历漏洞

Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the getPackageImpl process. An attacker can introduce unauthorized packages into built images by substituting download responses from a compromised mirror, HTTP repository, or poisoned CDN...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the getPackageImpl process. An attacker can introduce unauthorized packages into built images by substituting download responses from a compromised mirror, HTTP repository, or poisoned CDN...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the DirFS process. An attacker can gain unauthorized access to files outside the intended build root by crafting a malicious archive containing a symlink entry that points outside the build root, followed by...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the DirFS process. An attacker can gain unauthorized access to files outside the intended build root by crafting a malicious archive containing a symlink entry that points outside the build root, followed by...

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

Impact A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the...

GHSA-QQ3R-W4HJ-GJP6 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

Impact A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the...

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString, and the downloaded package control hash is computed, but the two values are never...

PT-2026-36990

Name of the Vulnerable Software and Affected Versions apko affected versions not specified Description apko verifies the signature on 'APKINDEX.tar.gz' but fails to compare individually downloaded '.apk' packages against the checksum recorded in the signed index. Although the checksum is parsed v...

PT-2026-37052

Name of the Vulnerable Software and Affected Versions apko versions 0.14.8 through 1.2.4 Description A crafted .apk file can install a TypeSymlink tar entry with a target pointing outside the build root. Subsequent directory-creation or file-write entries in the same or later archive can traverse...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dgraph, dkron, actions-runner-controller, malcontent, mariadb-operator, metacontroller, nodetaint, tailscale, smokescreen, karpenter, temporal, victoriametrics, clickhouse-operator, aws-network-policy-agent, gh, spire-server, oras, sftpgo-plugin-eventsearch, polaris,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: kyverno, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, livekit-cli, k9s-fips, grafana-fips, k9s, kaniko, argo-cd, gitea, dagger, witness, guac, kots, pulumi, osv-scanner, flux-source-controller-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kyverno, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, livekit-cli, k9s-fips, grafana-fips, k9s, kaniko, argo-cd, gitea, dagger, witness, guac, kots, pulumi, osv-scanner, flux-source-controller-fips,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: kyverno, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, livekit-cli, k9s-fips, grafana-fips, k9s, kaniko, argo-cd, gitea, dagger, witness, guac, kots, pulumi, osv-scanner, flux-source-controller-fips,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: trivy, guac, trufflehog, zarf, nuclei, argocd-image-updater, gomplate, argo-workflows, cerbos, nfpm, gitaly, gitea, trivy-operator, tfsec, grafana-alloy, dagger, xeol, flux-image-automation-controller, scorecard, wolfictl, kaniko, grype, external-secrets-operator,...