Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:56:56 +0000 CVE-2026-42574 — apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root https://vulnerability.circl.lu/vuln/cve-2026-42574 <p><strong>Affected:</strong> chainguard-dev apko</p> <p>apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.</p> <p><strong>Affected:</strong> chainguard-dev apko</p> <p>apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.</p> https://vulnerability.circl.lu/vuln/cve-2026-42574