7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25121

CVE-2026-25121: apko has a path traversal in apko dirFS which allows filesystem writes outside base

A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.

Fix: Fixed by d8b7887. Merged into release.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25121

CVE-2026-25121:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/apko	go	>= 0.14.8, < 1.1.0	1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the dirFS filesystem abstraction within apko, specifically in how it handles file and directory creation. The methods MkdirAll, Mkdir, Symlink, and Link in pkg/apk/fs/rwosfs.go were identified as vulnerable. These functions directly used filepath.Join to concatenate a base directory with a path from an APK package. This was unsafe because filepath.Join does not, by itself, prevent path traversal attacks using ../ components. An attacker could craft a malicious APK with paths that traverse up the directory tree, allowing them to create directories, symbolic links, or hard links outside of the intended installation root. The patch addresses this by introducing a new sanitizePath function that validates the resulting path to ensure it remains within the intended base directory before performing any filesystem operations. This sanitization is now applied to all filesystem-modifying functions within dirFS as a comprehensive fix.

Vulnerable functions

(*dirFS).MkdirAll

pkg/apk/fs/rwosfs.go

The function `MkdirAll` is vulnerable to path traversal because it uses `filepath.Join` to construct a path from a base directory and a user-provided name without proper sanitization. An attacker could provide a name with `../` sequences to create directories outside the intended base directory.

(*dirFS).Mkdir

pkg/apk/fs/rwosfs.go

The function `Mkdir` is vulnerable to path traversal because it uses `filepath.Join` to construct a path from a base directory and a user-provided name without proper sanitization. An attacker could provide a name with `../` sequences to create a directory outside the intended base directory.

(*dirFS).Symlink

pkg/apk/fs/rwosfs.go

The function `Symlink` is vulnerable to path traversal. It uses `filepath.Join` to construct the path for the new symlink (`newname`) without validating that the resulting path is within the base directory. This allows an attacker to create a symbolic link pointing to an arbitrary location on the filesystem.

(*dirFS).Link

pkg/apk/fs/rwosfs.go

The `Link` function is vulnerable to path traversal. It constructs the path for the new hardlink name (`newname`) using `filepath.Join` without sanitization, allowing an attacker to create a hardlink outside of the intended base directory, potentially overwriting or linking to sensitive files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.