Symlink Vulnerability in apko Container Image Builder by Chainguard
CVE-2026-42574
7.5HIGH
What is CVE-2026-42574?
The vulnerability in apko allows the creation of OCI container images from apk packages. Specific versions (0.14.8 to before 1.2.5) are susceptible to a crafted .apk that can install a TypeSymlink tar entry. This entry's target may point outside the build root, leading to potential file system traversal and unauthorized access to host paths that the build user can write to. This issue has been addressed in version 1.2.5, and users are advised to update to this version to ensure their systems are secure.
Affected Version(s)
apko >= 0.14.8, < 1.2.5