Path Traversal Vulnerability in Melange by Chainguard

CVE-2026-25145

What is CVE-2026-25145?

The vulnerability in Melange allows attackers to exploit configurations, potentially leading to unauthorized access to arbitrary files on the host system. Using the LicensingInfos function within the package configuration file, an attacker could leverage path traversal techniques, such as the use of ../ sequences, to read sensitive files outside the designated workspace directory. This could result in sensitive information being embedded in the generated Software Bill of Materials (SBOM), thus facilitating data exfiltration through build artifacts. Users are advised to upgrade to version 0.40.3 or later, where this issue has been addressed and patched.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References