Beveiligingsadvies

CVE-2026-42574

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-09 19:24:48

Laatst bijgewerkt 2026-05-11 17:11:40

Toegewezen door GitHub_M

CVSS-score 7.5

Status PUBLISHED

Beschrijving

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

← Alle CVE's bekijken Bekijk op cve.org ↗