8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24843

CVE-2026-24843: melange QEMU runner could write files outside workspace directory

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries without validating that paths stay within the workspace, allowing path traversal via ../ sequences. This issue has been patched in version 0.40.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24843

CVE-2026-24843:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/melange	go	>= 0.11.3, < 0.40.3	0.40.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue located in the retrieveWorkspace function within the Build struct in pkg/build/build.go. This function's purpose is to extract a tar archive, which represents the build workspace, from a QEMU virtual machine. The core of the vulnerability lies in the lack of validation of the file paths for the entries within the tar archive before they are written to the host's filesystem.

The security advisory and the commit message for the patch 6e243d0d46699f837d7c392397a694d2bcc7612b confirm this. The patch introduces a new helper function, isValidPath, specifically designed to prevent path traversal by checking for absolute paths, '..' sequences, and null bytes.

Inside the vulnerable retrieveWorkspace function, the patch strategically inserts calls to this new isValidPath function at critical points:

It validates the hdr.Name for every single entry in the tar archive, which is the primary fix that closes the path traversal loophole.
It adds further validation for hdr.Linkname for both symbolic links (tar.TypeSymlink) and hard links (tar.TypeLink), preventing attacks where a link might point to a sensitive file outside the workspace.

Because the vulnerability is triggered during the processing of a malicious tar file by this function, Build.retrieveWorkspace is the precise function that would be active and appear in a runtime profile or stack trace during an exploit.

Vulnerable functions

Build.retrieveWorkspace

pkg/build/build.go

The `retrieveWorkspace` function is responsible for extracting a tar archive from a QEMU guest. Prior to the patch, this function did not validate the paths of the files contained within the tar archive. This allowed an attacker who could control the tar stream to include '..' path traversal sequences in the filenames. When extracted on the host, these malicious paths would allow the attacker to write files outside of the intended workspace directory, leading to arbitrary file writes on the host system. The patch adds calls to a new `isValidPath` function to sanitize and validate all entry paths and link targets within the tar archive before extraction.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.