Listen to this Post
How the CVE Works:
The vulnerability exists within the `dirFS` filesystem abstraction in apko’s pkg/apk/fs/rwosfs.go. The methods MkdirAll, Mkdir, and `Symlink` construct paths using `filepath.Join()` with user-controlled input from APK package metadata, such as directory or symlink target names. This function does not prevent the inclusion of path traversal sequences like ../../../. Without subsequent validation to confine the resolved path within the intended root base directory, an attacker can craft a malicious APK package where these sequences cause the operations to create directories or symbolic links at arbitrary locations on the host filesystem during the image building process. This bypasses the container sandbox, leading to arbitrary file write.
DailyCVE Form:
Platform: apko
Version: pre-d8b7887
Vulnerability: Path Traversal
Severity: Critical
Date: 2026-02-03
Prediction: 2026-02-10
What Undercode Say:
Analytics:
git clone https://github.com/chainguard-dev/apko cd apko git checkout <commit-before-d8b7887> grep -n "filepath.Join" pkg/apk/fs/rwosfs.go
// In pkg/apk/fs/rwosfs.go (vulnerable code)
func (r rwOSFS) Mkdir(name string, perm fs.FileMode) error {
path := filepath.Join(r.root, name) // 'name' may contain '../'
return os.Mkdir(path, perm)
}
How Exploit:
- Create a malicious APK package with a directory entry named
../../../etc/cron.d. - Use apko to build an image incorporating this malicious package.
- The `MkdirAll` call executes, creating the directory at `/etc/cron.d/` on the host builder filesystem.
Protection from this CVE:
Update apko to commit `d8b7887` or later. Apply path sanitization using `fs.ValidPath()` or explicit checks using `fs.ValidPath()` or explicit checks using `filepath.Clean` and comparing with the intended root directory prefix.
Impact:
Arbitrary Filesystem Write, Container Escape, System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
