{
  "ticket_id": "CVE-2026-42574",
  "code_root": "external/apko",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-42574",
    "advisory_id": "GHSA-qq3r-w4hj-gjp6",
    "advisory_url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-qq3r-w4hj-gjp6",
    "vendor": "chainguard-dev",
    "product": "apko",
    "repo": "https://github.com/chainguard-dev/apko"
  },
  "facts": {
    "cve_id": "CVE-2026-42574",
    "advisory_id": "GHSA-qq3r-w4hj-gjp6",
    "issue_summary": "apko's package install path uses dirFS, which follows symlinks. A crafted .apk package can install a TypeSymlink tar entry whose target points outside the build root; a later directory-creation or file-write tar entry then resolves through that planted symlink and writes outside the build root, allowing path traversal during apk install.",
    "vulnerability_type": "Path Traversal (symlink following on apk install)",
    "suspected_cwe": ["CWE-22"],
    "affected_versions": "chainguard.dev/apko 0.14.8 to < 1.2.5",
    "fixed_versions": ["1.2.5"],
    "reproduce_version": "1.2.4",
    "verify_fixed_version": "1.2.5",
    "repo_url": "https://github.com/chainguard-dev/apko.git",
    "fix_commit": "f5a96e1299ac81c7ea9441705ec467688086f442",
    "code_root": "external/apko",
    "ecosystem": "Go",
    "package": "chainguard.dev/apko",
    "install_recipe": "Build a Go test or program that depends on the apko module. Pin the module to chainguard.dev/apko v1.2.4 (vulnerable) or v1.2.5 (fixed). The published Go module versions are the canonical artifacts.",
    "attacker_access": "An attacker who controls the contents of an .apk package that apko installs into a build root.",
    "exploit_outline": "Craft an .apk package containing a TypeSymlink tar entry whose target points outside the build root, followed by a directory-creation or file-write tar entry whose path resolves through that planted symlink. Run the crafted .apk through apko's package install path. Because dirFS follows symlinks, the later write entry escapes the build root.",
    "vulnerable_indicator": "On apko 1.2.4 installing the crafted .apk writes a file at a path outside the build root - a file appears on the filesystem outside the intended build root directory.",
    "fixed_indicator": "On apko 1.2.5 the package install path rejects the traversal; the write through the planted symlink is blocked and no file is created outside the build root.",
    "reproduction_requirements": "A Go toolchain and the chainguard.dev/apko module at the specified version. A crafted .apk package containing a symlink entry followed by a write entry through it. No external network, database, or browser required - the difference is observable as a file written outside the build root on the local filesystem.",
    "notes": "Root cause is dirFS following symlinks during apk install; the fix commit is f5a96e1299ac81c7ea9441705ec467688086f442 in apko 1.2.5, which rejects the symlink-following traversal."
  }
}