« Volver al listado

CVE-2026-42574

Estado: AplazadaAlta (7.5)—

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de recorrido de directorios (CWE-22) en herramienta de construcción de contenedores accesible remotamente via archivo .apk manipulado (AV:N/PR:N/UI:N). Permite escritura fuera del sandbox, potencial escalada si el usuario ejecutor tiene privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Chainguard — ApkoAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42574",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42574",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T17:09:56.626237Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "chainguard-dev",
          "product": "apko",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.14.8, < 1.2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-09T20:16:29.420",
  "references": [
    {
      "url": "https://github.com/chainguard-dev/apko/commit/f5a96e1299ac81c7ea9441705ec467688086f442",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/pull/2187",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/releases/tag/v1.2.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. This issue has been patched in version 1.2.5."
    },
    {
      "lang": "es",
      "value": "apko permite a los usuarios construir y publicar imágenes de contenedor OCI creadas a partir de paquetes apk. Desde la versión 0.14.8 hasta antes de la versión 1.2.5, un .apk manipulado podría instalar una entrada tar TypeSymlink cuyo objetivo apuntaba fuera de la raíz de construcción, y una entrada posterior de creación de directorio o escritura de archivo en el mismo archivo o en uno posterior podría atravesar ese enlace simbólico para alcanzar rutas del host a las que el usuario de construcción podría escribir. Este problema ha sido parcheado en la versión 1.2.5."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "sourceIdentifier": "security-advisories@github.com"
}