CVE-2026-25121: apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-04 · updated 2026-06-17
Weakness: CWE-23

Description

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.

Affected products

chainguard-dev apko: from 0.14.8 before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: chainguard-dev apko 1.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25121 or the next vulnerability affects your stack