apko 在 apko dirFS 中存在路径遍历漏洞，允许在基础目录之外进行文件系统写入

攻击者可以利用此漏洞在 apko 的安装过程中创建任意文件或目录，绕过安全限制。这可能导致攻击者在目标系统上执行恶意代码，窃取敏感数据，或进行横向移动。例如，攻击者可以创建一个指向系统关键文件的符号链接，从而修改其行为。由于 apko 广泛用于构建和部署容器镜像，因此此漏洞的潜在影响范围非常广泛，可能影响依赖 apko 的应用程序和基础设施。

Organizations and developers using chainguard.dev/apko for building APK images, particularly those relying on external or untrusted repositories for APK packages, are at risk. Shared hosting environments where multiple users share the same apko installation are also particularly vulnerable, as a compromised APK package from one user could potentially impact other users.

• linux / server: Monitor apko process file system activity using lsof or auditd for unexpected writes outside the intended installation directory.

lsof -p $(pgrep apko) | grep '/outside/intended/path/'

• generic web: Inspect APK package metadata for suspicious file paths or directory structures before processing. Use tools like zip -v to examine the contents of the APK. • go: Review the pkg/apk/fs/rwosfs.go file for instances of filepath.Join() without proper path validation. Look for potential bypasses of intended directory boundaries.

1. 2026-02-03Disclosure

   disclosure

1. 已保留2026-01-29
2. 发布日期2026-02-03
3. 修改日期2026-02-23
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即升级到 apko 1.1.0 或更高版本，该版本修复了此漏洞。如果无法立即升级，可以考虑以下临时缓解措施：限制 APK 仓库的访问权限，仅允许来自可信来源的 APK 包；实施严格的文件系统权限控制，防止攻击者创建任意文件或目录；监控 apko 的安装过程，检测可疑活动。升级后，请验证安装过程是否正常，并检查系统是否存在未经授权的文件或目录。