CVE-2026-25121

The CVE-2026-25121 entry concerns a path traversal in apko’s dirFS (package apko) where MkdirAll, Mkdir, and Symlink in rwosfs.go use filepath.Join() without validating the path against the base directory. A malicious APK package (e.g., from a compromised or typosquatted repo) could cause writes ...

CVE-2026-25140

The CVE-2026-25140 issue affects chainguard.dev/apko: ExpandApk() expands .apk streams without decompression limits, enabling an attacker-controlled APK repository to inflate a small, highly-compressed archive into a large tar stream. This unbounded expansion can exhaust disk space and CPU on the...

CVE-2026-25122

CVE-2026-25122 affects chainguard.dev/apko: unbounded resource consumption in expandapk.Split when processing attacker-controlled .apk streams. From 0.14.8 up to (but not including) 1.1.0, the first gzip stream is drained without a maximum uncompressed byte limit, enabling excessive CPU inflation...