Path Traversal Vulnerability in Apko Container Image Builder from Chainguard

CVE-2026-25121

What is CVE-2026-25121?

A path traversal vulnerability has been discovered in Apko's dirFS filesystem abstraction, which could be exploited by attackers providing a malicious APK package through compromised or spoofed repositories. This vulnerability allows unauthorized directory creation or symbolic link creation outside of the intended installation directory. The underlying issue arises from the improper use of filepath.Join() in the MkdirAll, Mkdir, and Symlink methods, lacking sufficient validation to restrict the resulting path within the specified base directory. Users are advised to update to version 1.1.1 or later for protection.

References