Security Advisory

CVE-2026-42574

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-09 19:24:48

Last updated 2026-05-11 17:11:40

Assigner GitHub_M

CVSS score 7.5

State PUBLISHED

Description

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

← Browse all CVEs View on cve.org ↗