apko में apko dirFS में एक पाथ ट्रावर्सल भेद्यता है जो बेस के बाहर फ़ाइलसिस्टम लेखन की अनुमति देती है

The impact of this vulnerability is significant. An attacker who can inject a malicious APK package, for example, through a compromised repository or typosquatting, can leverage the Path Traversal flaw to escape the intended installation boundaries. This could allow them to write files to arbitrary locations on the system, potentially overwriting critical system files, installing malware, or gaining persistent access. The ability to create symbolic links further amplifies the risk, as attackers could redirect system resources or create deceptive file structures. This vulnerability highlights the importance of secure package management and verifying the integrity of software sources.

Organizations and developers using chainguard.dev/apko for building APK images, particularly those relying on external or untrusted repositories for APK packages, are at risk. Shared hosting environments where multiple users share the same apko installation are also particularly vulnerable, as a compromised APK package from one user could potentially impact other users.

• linux / server: Monitor apko process file system activity using lsof or auditd for unexpected writes outside the intended installation directory.

lsof -p $(pgrep apko) | grep '/outside/intended/path/'

• generic web: Inspect APK package metadata for suspicious file paths or directory structures before processing. Use tools like zip -v to examine the contents of the APK. • go: Review the pkg/apk/fs/rwosfs.go file for instances of filepath.Join() without proper path validation. Look for potential bypasses of intended directory boundaries.

1. 2026-02-03Disclosure

   disclosure

1. आरक्षित2026-01-29
2. प्रकाशित2026-02-03
3. संशोधित2026-02-23
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-25121 is to upgrade to version 1.1.0 or later of chainguard.dev/apko. If upgrading is not immediately feasible, consider implementing stricter input validation on APK packages before processing them. This could involve whitelisting allowed package sources or implementing checks to ensure that the APK package does not contain suspicious file paths. Additionally, review and harden the permissions granted to the apko process to limit its ability to write to sensitive locations. After upgrading, confirm the fix by attempting to create directories or symbolic links outside the intended installation root using a test APK package.