CVE-2026-25145: melange has a path traversal in license-path which allows reading files outside workspace

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-04 · updated 2026-06-17
Weakness: CWE-22

Description

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright[].license-path without validating that paths remain within the workspace directory, allowing path traversal via ../ sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts. This issue has been patched in version 0.40.3.

Affected products

chainguard-dev melange: from 0.14.0 before 0.40.5 — fixed in 0.40.5

How to fix

Upgrade to a fixed version: chainguard-dev melange 0.40.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25145 or the next vulnerability affects your stack