Path Traversal Vulnerability in Apko Container Image Builder from Chainguard

CVE-2026-25121

What is CVE-2026-25121?

A path traversal vulnerability has been discovered in Apko's dirFS filesystem abstraction, which could be exploited by attackers providing a malicious APK package through compromised or spoofed repositories. This vulnerability allows unauthorized directory creation or symbolic link creation outside of the intended installation directory. The underlying issue arises from the improper use of filepath.Join() in the MkdirAll, Mkdir, and Symlink methods, lacking sufficient validation to restrict the resulting path within the specified base directory. Users are advised to update to version 1.1.1 or later for protection.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References